Harden nuget per-request index rewrite (#149)

NuGet index rewrites embed the client Host and X-Forwarded-Proto into per-request JSON, so a shared cache could store one host's URLs, a forged header could inject content, HEAD skipped the rewrite, and immutable flat-container blobs were re-validated as mutable.

- set `no-store`, `Vary: Host, X-Forwarded-Proto` and the rewritten Content-Length on GET and HEAD
- share `v1.Scheme()` (first X-Forwarded-Proto value, `http`/`https` only) across nuget, cargo, virtual redirects and the terraform registry
- reject non host[:port] Host headers and JSON-escape the injected base URL
- classify `.snupkg`, `readme` and `icon` flat-container blobs as immutable

requires unkin/artifactapi#148 merged first

Reviewed-on: #149
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

e2e/head_test.go

@@ -40,8 +40,10 @@ func assertHeadMatchesGet(t *testing.T, url string) {
 	if len(hb) != 0 {
 		t.Errorf("HEAD returned a %d-byte body", len(hb))
 	}
-	if head.Header.Get("Content-Type") != get.Header.Get("Content-Type") {
-		t.Errorf("HEAD Content-Type %q, GET %q", head.Header.Get("Content-Type"), get.Header.Get("Content-Type"))
+	for _, h := range []string{"Content-Type", "Cache-Control", "Vary"} {
+		if head.Header.Get(h) != get.Header.Get(h) {
+			t.Errorf("HEAD %s %q, GET %q", h, head.Header.Get(h), get.Header.Get(h))
+		}
 	}
 	if head.ContentLength != int64(len(body)) {
 		t.Errorf("HEAD Content-Length %d, GET body %d bytes", head.ContentLength, len(body))
@@ -61,7 +63,19 @@ func TestProxyHeadNuGetRewritten(t *testing.T) {
 	createRemote(t, mustFormat(`{"name": "head-nuget", "package_type": "nuget", "base_url": %q}`, upstream.URL+"/v3/index.json"))
 	defer deleteRemote(t, "head-nuget")
 
-	assertHeadMatchesGet(t, apiURL("/api/v1/remote/head-nuget/index.json"))
+	url := apiURL("/api/v1/remote/head-nuget/index.json")
+	assertHeadMatchesGet(t, url)
+
+	req, _ := http.NewRequest(http.MethodHead, url, nil)
+	req.Host = "evil.example:"
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Errorf("HEAD with invalid Host: got %d, want 400", resp.StatusCode)
+	}
 }
 
 func TestProxyHeadGitHubRPMRepodata(t *testing.T) {

e2e/scheme_test.go

@@ -0,0 +1,59 @@
+//go:build e2e
+
+package e2e
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+func getForwardedHTTPS(t *testing.T, url string) *http.Response {
+	t.Helper()
+	req, _ := http.NewRequest(http.MethodGet, url, nil)
+	req.Header.Set("X-Forwarded-Proto", "https")
+	client := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("GET %s: %v", url, err)
+	}
+	return resp
+}
+
+func TestForwardedProtoCargoConfig(t *testing.T) {
+	createRemote(t, `{"name": "scheme-cargo", "package_type": "cargo", "base_url": "https://index.crates.io"}`)
+	defer deleteRemote(t, "scheme-cargo")
+
+	resp := getForwardedHTTPS(t, apiURL("/api/v1/remote/scheme-cargo/config.json"))
+	defer resp.Body.Close()
+	var cfg map[string]string
+	if err := json.NewDecoder(resp.Body).Decode(&cfg); err != nil {
+		t.Fatal(err)
+	}
+	if want := "https://" + strings.TrimPrefix(baseURL, "http://") + "/api/v1/remote/scheme-cargo/"; !strings.HasPrefix(cfg["dl"], want) {
+		t.Errorf("dl = %q, want prefix %q", cfg["dl"], want)
+	}
+}
+
+func TestForwardedProtoVirtualRedirect(t *testing.T) {
+	createRemote(t, `{"name": "scheme-rpm", "package_type": "rpm", "base_url": "https://rpm.example.com"}`)
+	defer deleteRemote(t, "scheme-rpm")
+	resp, err := http.Post(apiURL("/api/v2/virtuals"), "application/json",
+		strings.NewReader(`{"name": "scheme-virt", "package_type": "rpm", "members": ["scheme-rpm"]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create virtual: status %d", resp.StatusCode)
+	}
+	defer deleteRequest(t, apiURL("/api/v2/virtuals/scheme-virt"))
+
+	resp = getForwardedHTTPS(t, apiURL("/api/v1/virtual/scheme-virt/scheme-rpm/Packages/a.rpm"))
+	resp.Body.Close()
+	loc := resp.Header.Get("Location")
+	if want := "https://" + strings.TrimPrefix(baseURL, "http://") + "/api/v1/remote/scheme-rpm/Packages/a.rpm"; resp.StatusCode != http.StatusFound || loc != want {
+		t.Errorf("redirect = %d %q, want 302 %q", resp.StatusCode, loc, want)
+	}
+}