feat(modules): add cockpit and gitea fingerprint modules#272
Conversation
github-actions
Bot
added
size/m
pr summary4 files changed (+79 -3)
|
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #272 +/- ##
=======================================
Coverage ? 64.85%
=======================================
Files ? 86
Lines ? 7637
Branches ? 0
=======================================
Hits ? 4953
Misses ? 2300
Partials ? 384 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
vmfunc
left a comment
vmfunc
left a comment
There was a problem hiding this comment.
cockpit-panel is right, status 200 anded with the three dom anchors, generic 200 won't trip it. that half's in.
the gitea half has two problems.
favicon-gitea.yaml is dead. the yaml module executor has no favicon matcher: module.go Matcher has no hash field and executor.go checkMatcher default-returns-false for anything that isn't status/word/regex. matchers are and'd, so that template is status 200 && false == never fires. favicon fingerprinting doesn't go through the module path at all, it lives in internal/scan/favicon.go behind -favicon. so this file matches nothing. drop it.
and favicon.go line 70 isn't "no drift", it rewrites the existing gitea entry from -1893514588 to -1668137428. if the old hash was a valid older-gitea icon you just lost coverage for it. add the new one as a second entry mapping to gitea instead of replacing, and tell me where -1668137428 came from... which gitea version, verified how. that map is the only thing that actually detects gitea here.
cockpit stays, rework the gitea side and this is in.
cockpit-panel keys on the login page's three stable dom anchors (user/password input ids and the cockpit login script path) under an and-condition, so a generic 200 cannot trip it. favicon-gitea matches gitea's default favicon hash, already present in the canonical favicon map.
…for another the table carried a single Gitea hash and this branch originally replaced it, which silently drops whatever the old entry covered. gitea reskinned its default icon twice, so one hash was never enough. hashing public/assets/img/favicon.png at each release tag with FaviconHash gives the real spread: 975625564 8268 bytes v1.4-v1.8 1969970750 5576 bytes v1.9-v1.12 -564935264 4873 bytes v1.13 -754147112 4351 bytes v1.15-v1.24 -1668137428 4335 bytes v1.25 onward -1668137428 is confirmed live against gitea.com (1.27.0+dev) and demo.gitea.com (1.28.0+dev), both serving /favicon.ico as that png. -754147112 spans nine minor releases and was the real coverage gap, so add it alongside. pre-v1.15 icons stay out, those releases are long EOL. the pre-existing -1893514588 entry is kept: it matches none of the tagged release icons above, so its provenance is unclear, but removing coverage that might be real is worse than carrying an unverified entry. codeberg (forgejo) hashes 1315211563, so none of these collide with it.
drop top-line comments that just restate the id/name fields already present in the same file
dfc04a4 to
c2078b9
Compare
|
the favicon.go half is entirely fair and I have fixed it, see below. on the the yaml executor does have a favicon matcher on main: Matcher carries on the hash: you are right that it was a replacement and not "no drift", and my 975625564 8268 bytes v1.4-v1.8 -1668137428 is also confirmed live against gitea.com (1.27.0+dev) and that turned up a bigger gap than the one under review: -754147112 covers nine I kept -1893514588 rather than dropping it. it matches none of the tagged release the table also moved to internal/fingerprint after #358, so the change is there |
There was a problem hiding this comment.
Pull request overview
Adds two new info-severity fingerprint modules (Cockpit login page and Gitea favicon) and expands the canonical favicon hash→tech map to cover multiple Gitea favicon generations, with tests updated to pin the expanded table and ensure all known Gitea hashes resolve.
Changes:
- Added
cockpit-panelHTTP module that fingerprints Cockpit via stable login-page DOM anchors under an AND condition. - Added
favicon-giteaHTTP module that fingerprints Gitea via multiple default favicon hashes. - Extended
internal/fingerprint’s canonical favicon hash table with additional Gitea hashes and updated/added tests to pin and validate the expanded mapping.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| modules/info/favicon-gitea.yaml | New favicon-based Gitea fingerprint module using multiple hash generations. |
| modules/info/cockpit-panel.yaml | New Cockpit login page fingerprint module using stable DOM anchors. |
| internal/fingerprint/favicon.go | Adds additional Gitea favicon hashes to the canonical hash→tech map. |
| internal/fingerprint/favicon_test.go | Updates pinned entry count and adds a test ensuring all known Gitea hashes resolve. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| id: cockpit-panel | ||
| info: | ||
| name: Cockpit Login Panel |
| id: favicon-gitea | ||
| info: | ||
| name: Gitea Favicon Fingerprint |
| - -754147112 # v1.15 through v1.24 | ||
| - -1668137428 # v1.25 onward |
| // gitea reskinned its default icon twice, so one hash does not cover the | ||
| // deployed population. each of these is public/assets/img/favicon.png at the | ||
| // tagged release, hashed with FaviconHash above: | ||
| // -754147112 4351 bytes v1.15 through v1.24 | ||
| // -1668137428 4335 bytes v1.25 onward, confirmed live against | ||
| // gitea.com (1.27.0+dev) and demo.gitea.com (1.28.0+dev) | ||
| // pre-v1.15 icons (v1.4-v1.8, v1.9-v1.12, v1.13) are left out; those | ||
| // releases are long EOL and the table stays high-signal defaults only. |
two info-severity fingerprint modules.
cockpit-paneldetects an exposed Cockpit web console: keys on the login page's three stable dom anchors (the user and password input ids and the cockpit login script path) under an and-condition, so a generic 200 cannot trip it.favicon-giteamatches Gitea's default favicon. gitea reskinned that icon twice, so one hash never covered the deployed population. hashingpublic/assets/img/favicon.pngat each release tag withFaviconHashgives:-1668137428 is confirmed live against gitea.com (1.27.0+dev) and demo.gitea.com (1.28.0+dev), both serving /favicon.ico as that png. -754147112 spans nine minor releases and was the real coverage gap, so both are in the canonical table and the module lists both. pre-v1.15 icons stay out, those releases are long EOL.
the pre-existing -1893514588 entry is kept. it matches none of the tagged release icons above so its provenance is unclear, but removing coverage that might be real is worse than carrying an unverified entry. codeberg (forgejo) hashes 1315211563, so none of these collide with it.