peptide-repo/peptide-starter-theme
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.5.2: CF-peer validated client IP, grandfather migration, de-short-circuit register

Browse Source 
Security follow-up to v1.5.1. Closes four items from the v1.5.1 review —
two ship-blockers and two mediums — all within the ADR-0001 envelope.

PSEC-007 — peptide_starter_get_client_ip() now trusts CF-Connecting-IP
only when REMOTE_ADDR falls inside a published Cloudflare edge range.
Previously, any direct-to-origin request (which Hostinger permits) could
forge its rate-limit key by setting the header to a different IP per
attempt, bypassing every abuse control in the theme. New module
inc/cloudflare-ips.php embeds a dated snapshot of CF v4/v6 ranges and a
CIDR matcher covering both families; list is overridable via the
peptide_starter_cloudflare_ip_ranges filter for out-of-band updates.
HTTP_X_FORWARDED_FOR stays ignored unless operators opt in via the
peptide_starter_trust_xff filter.

PSEC-008 — Removed the v1.5.1 user-verification migration (Option A as
confirmed by peptiderepo). The sync-wp_mail-per-subscriber loop on
admin_init would have blocked wp-admin and hammered deliverability.
Existing accounts are now grandfathered: no ps_pending_verification
meta = verified. Verification applies only to registrations from v1.5.2
forward. The ps_verify_migration_version option (written by v1.5.1) is
cleared on theme activation.

PSEC-009 — Registration validation no longer short-circuits. All five
checks (username pattern, email validity, password length,
username_exists, email_exists) evaluate unconditionally before the
combined rejection. Closes the response-time oracle that let an
attacker distinguish microsecond-fast regex rejection from DB-round-trip
rejection and infer which field triggered the failure.

PSEC-010 — Added the happy-path verify test that v1.5.1 was missing.
Covers token match, user meta cleanup, auth cookie set, and the
peptide_starter_user_verified action firing with the correct user ID.

Seven new rate-limiter tests confirm CF-peer validation works
end-to-end: trusted CF peer honours the header, untrusted peer ignores
spoofed headers, invalid values fall through, XFF default-off, XFF
filter opt-in, CF range filter override, IPv6 CIDR match, family
mismatch rejection.

Confirmed with peptiderepo before coding: (1) Option A for PSEC-008
because zero users; (2) Cloudflare IS in front of the origin (dig
confirms 104.21.x / 172.67.x + CF-Ray response header), so PSEC-007 is
a real fix not dead code; (3) no staging — treat prod as staging.

ARCHITECTURE.md gains a client-IP trust model section; CONVENTIONS.md
documents the header-trust rules for future modules.

Version bumped to 1.5.2 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
2026-04-14 15:39:09 +07:00
parent 3e1c12c94b
commit fff3fce432
13 changed files with 573 additions and 192 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
tests/test-auth-handlers.php
View File

@@ -137,6 +137,51 @@ class Test_Auth_Handlers extends WP_UnitTestCase {
$this->assertSame( peptide_starter_register_failure_message(), $this->captured['data']['message'] );
}
/**
* PSEC-009: registration validation path is not short-circuit.
*
* We can't directly mock `preg_match` / `username_exists` etc. from
* userland. Instead, we assert the behavioural contract: even when an
* early check has already failed (invalid username pattern), the
* handler still runs the later DB-backed checks. We observe this by
* filtering `pre_user_login` which wp_create_user-adjacent code paths
* consult, and by checking that `username_exists` was called via a
* filter it would fire. A simpler surrogate is to hook into WordPress'
* `user_search_query` / `query` action and confirm at least one user
* lookup happened during a failing registration — which would not
* happen if the handler short-circuited on the pattern failure.
*/
public function test_register_runs_all_checks_even_when_early_one_fails() {
$queries_ran = 0;
$counter = function ( $query ) use ( &$queries_ran ) {
// wp_cache_get avoids counting ourselves. We only care whether
// any user-table-touching query fires during the handler run.
if ( is_string( $query ) && false !== stripos( $query, 'users' ) ) {
$queries_ran++;
}
return $query;
};
add_filter( 'query', $counter );
update_option( 'users_can_register', 1 );
$_POST = array(
'ps_register_nonce' => wp_create_nonce( 'ps_auth_register' ),
'username' => 'ab', // Too short — early check fails.
'email' => 'validformat@example.com',
'password' => 'longenoughpassword',
);
try { peptide_starter_ajax_register(); } catch ( WPAjaxDieStopException $e ) { /* ok */ }
remove_filter( 'query', $counter );
$this->assertGreaterThan(
0,
$queries_ran,
'username_exists / email_exists must still run even when pattern check fails (PSEC-009 non-short-circuit).'
);
$this->assertSame( peptide_starter_register_failure_message(), $this->captured['data']['message'] );
}
public function test_register_duplicate_email_returns_unified_message() {
self::factory()->user->create( array( 'user_email' => 'dup@example.com' ) );
update_option( 'users_can_register', 1 );

44
tests/test-email-verification.php
View File

@@ -44,6 +44,50 @@ class Test_Email_Verification extends WP_UnitTestCase {
$this->assertFalse( peptide_starter_user_is_verified( $user_id ) );
}
public function test_valid_token_verifies_user_clears_meta_and_fires_hook() {
$user_id = self::factory()->user->create();
peptide_starter_send_verification_email( $user_id );
$token = get_user_meta( $user_id, 'ps_verify_token', true );
$this->assertNotEmpty( $token );
$_GET['uid'] = $user_id;
$_GET['token'] = $token;
set_query_var( 'ps_verify', 1 );
$redirected = null;
$hook_user_id = null;
add_filter(
'wp_redirect',
function ( $url ) use ( &$redirected ) {
$redirected = $url;
return false;
}
);
add_action(
'peptide_starter_user_verified',
function ( $uid ) use ( &$hook_user_id ) {
$hook_user_id = $uid;
}
);
try {
peptide_starter_handle_verify_request();
} catch ( Exception $e ) { /* exit path */ }
$this->assertNotNull( $redirected, 'Must redirect on successful verify.' );
$this->assertStringContainsString( 'verified=1', (string) $redirected );
$this->assertSame( '', (string) get_user_meta( $user_id, 'ps_pending_verification', true ) );
$this->assertSame( '', (string) get_user_meta( $user_id, 'ps_verify_token', true ) );
$this->assertSame( '', (string) get_user_meta( $user_id, 'ps_verify_expires', true ) );
$this->assertSame( $user_id, get_current_user_id(), 'User must be logged in after successful verify.' );
$this->assertSame( $user_id, $hook_user_id, 'peptide_starter_user_verified must fire with the user ID.' );
remove_all_filters( 'wp_redirect' );
remove_all_actions( 'peptide_starter_user_verified' );
set_query_var( 'ps_verify', 0 );
wp_set_current_user( 0 );
}
public function test_verification_handler_rejects_bad_token() {
$user_id = self::factory()->user->create();
peptide_starter_send_verification_email( $user_id );

59
tests/test-rate-limiter.php
View File

@@ -78,17 +78,66 @@ class Test_Rate_Limiter extends WP_UnitTestCase {
$this->assertStringNotContainsString( 'alice', $a );
}
public function test_client_ip_prefers_cf_header() {
public function test_client_ip_trusts_cf_header_when_peer_is_cloudflare() {
// 172.68.0.5 is inside 172.64.0.0/13 (published CF range).
$_SERVER['REMOTE_ADDR'] = '172.68.0.5';
$_SERVER['HTTP_CF_CONNECTING_IP'] = '203.0.113.5';
$_SERVER['REMOTE_ADDR'] = '10.0.0.1';
$this->assertSame( '203.0.113.5', peptide_starter_get_client_ip() );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'] );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'], $_SERVER['REMOTE_ADDR'] );
}
public function test_client_ip_rejects_garbage() {
public function test_client_ip_ignores_spoofed_cf_header_from_non_cloudflare_peer() {
// 8.8.8.8 is not Cloudflare — any CF-Connecting-IP header must be
// treated as hostile and ignored. This is PSEC-007.
$_SERVER['REMOTE_ADDR'] = '8.8.8.8';
$_SERVER['HTTP_CF_CONNECTING_IP'] = '203.0.113.5';
$this->assertSame( '8.8.8.8', peptide_starter_get_client_ip() );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'], $_SERVER['REMOTE_ADDR'] );
}
public function test_client_ip_rejects_invalid_cf_header_value() {
$_SERVER['REMOTE_ADDR'] = '172.68.0.5';
$_SERVER['HTTP_CF_CONNECTING_IP'] = 'not-an-ip';
$this->assertSame( '172.68.0.5', peptide_starter_get_client_ip() );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'], $_SERVER['REMOTE_ADDR'] );
}
public function test_client_ip_ignores_xff_by_default() {
$_SERVER['REMOTE_ADDR'] = '10.0.0.1';
$_SERVER['HTTP_X_FORWARDED_FOR'] = '203.0.113.5';
$this->assertSame( '10.0.0.1', peptide_starter_get_client_ip() );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'] );
unset( $_SERVER['HTTP_X_FORWARDED_FOR'], $_SERVER['REMOTE_ADDR'] );
}
public function test_client_ip_respects_xff_when_filter_enables_trust() {
$_SERVER['REMOTE_ADDR'] = '10.0.0.1';
$_SERVER['HTTP_X_FORWARDED_FOR'] = '203.0.113.5, 172.68.0.5';
add_filter( 'peptide_starter_trust_xff', '__return_true' );
$this->assertSame( '203.0.113.5', peptide_starter_get_client_ip() );
remove_filter( 'peptide_starter_trust_xff', '__return_true' );
unset( $_SERVER['HTTP_X_FORWARDED_FOR'], $_SERVER['REMOTE_ADDR'] );
}
public function test_cloudflare_ranges_filter_override_is_honoured() {
add_filter(
'peptide_starter_cloudflare_ip_ranges',
function () {
return array( 'v4' => array( '10.0.0.0/8' ), 'v6' => array() );
}
);
// Default snapshot would treat 172.68.0.5 as CF; filter override
// should now treat 10.0.0.5 as CF instead.
$this->assertTrue( peptide_starter_is_cloudflare_peer( '10.0.0.5' ) );
$this->assertFalse( peptide_starter_is_cloudflare_peer( '172.68.0.5' ) );
remove_all_filters( 'peptide_starter_cloudflare_ip_ranges' );
}
public function test_cidr_match_handles_ipv6() {
$this->assertTrue( peptide_starter_cidr_match( '2606:4700::1234', '2606:4700::/32' ) );
$this->assertFalse( peptide_starter_cidr_match( '2001:db8::1', '2606:4700::/32' ) );
}
public function test_cidr_match_rejects_family_mismatch() {
$this->assertFalse( peptide_starter_cidr_match( '203.0.113.5', '2606:4700::/32' ) );
}
}