Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-06-23 08:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add HSTS preload list check via the hstspreload.org API (#1248)

Browse Source 
Revives and rebases #1809 by @tosticated (Jim Blankendaal) onto 3.3dev. When --phone-out is set, run_hsts now queries https://hstspreload.org/api/v2/status and reports whether the domain is on the browser HSTS preload list (preloaded/pending/rejected/unknown), cross-referenced with the served header, the same-domain check and the bulk flag.

Addresses the review comments on #1809: the API-response matching uses native bash string matching instead of forking grep, the JSON quoting is handled inside check_hsts_preloadlist_match() so callers pass plain values, and the value arrays use 'local -a'. The output decision table is kept as-is (per maintainer feedback). Adds t/53_hsts_preload.t. Original design and decision table by @tosticated.
This commit is contained in:
potato-20
2026-06-11 16:30:45 +05:30
parent 826449115c
commit 57fc5850d1
5 changed files with 186 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
t/53_hsts_preload.t
+52
View File
@@ -0,0 +1,52 @@
#!/usr/bin/env perl
# Check the HSTS preload list status against the hstspreload.org API (needs --phone-out).
# github.com is on the preload list, example.com is not.
#
# We don't use a full run, only the HTTP header section.
use strict;
use Test::More;
my $tests = 0;
my $prg="./testssl.sh";
my $csv="tmp.csv";
my $cat_csv="";
my $check2run="-q --color 0 --phone-out --ip=one --headers --csvfile $csv";
my $uri="github.com";
my @args="";
die "Unable to open $prg" unless -f $prg;
# Provide proper start conditions
unlink $csv;
#1 run -- a domain which is on the HSTS preload list
printf "\n%s\n", "Unit test for HSTS preload list status against \"$uri\"";
@args="$prg $check2run $uri >/dev/null";
system("@args") == 0
or die ("FAILED: \"@args\" ");
$cat_csv=`cat $csv`;
# github.com is on the preload list
like($cat_csv, qr/"HSTS_preloadlist".*"preloaded"/,"\"$uri\" should be on the HSTS preload list");
$tests++;
unlink $csv;
#2 run -- a domain which is NOT on the HSTS preload list
$uri="example.com";
@args="$prg $check2run $uri >/dev/null";
system("@args") == 0
or die ("FAILED: \"@args\" ");
$cat_csv=`cat $csv`;
# example.com is not on the preload list
like($cat_csv, qr/"HSTS_preloadlist".*"unknown"/,"\"$uri\" should not be on the HSTS preload list");
$tests++;
unlink $csv;
done_testing($tests);
printf "\n";
# vim:ts=5:sw=5:expandtab