MigrateToFlarum Lab, the health scanner for Flarum

0E800

May you please offer me some advise regarding what I can do about my score.

https://lab.migratetoflarum.com/scans/5fbde959-723f-420f-8f8e-c6a13cbc4b46

Your forum is answering to multiple urls. Set redirects to a single canonical url. Assets won't load correctly on the non-canonical domains

I'm not sure what I am supposed to do to resolve it.

Thank you again for this quality tool.

Sanguine

0E800 you should force redirect https://www.keys-daggers to https://keys-daggers, like you already do for the none-https versions

clarkwinkelmann

Sanguine apparently you can score A+ whilst lacking a CSP header altogether

CSP being so complicated with Flarum right now I'm not taking it into account for the score.

Because having CSP with eval, inline-scripts and inline-style really is like having no CSP at all ?

Pollux

@clarkwinkelmann

I've got a B because "Is using non-permanent redirects". You suggest "Consider using a 301 permanent redirect instead (the browsers and search engines will cache it)".

But my .htaccess file already looks like that:

RewriteCond %{HTTP_HOST} ^www\.my-domain\.com [NC]
RewriteRule ^(.*)$ https://my-domain.com/$1 [R=301,L]

RewriteCond %{HTTPS} off [OR]
RewriteCond %{ENV:HTTPS} off
RewriteCond %{HTTP_HOST} ^my-domain\.com [NC]
RewriteRule ^(.*)$ https://my-domain.com/$1 [R=301,L]

Shouldn't that do exactly what you suggest?

clarkwinkelmann

Pollux these rules look fine... Yet the redirect is still 302 ?

I don't think the issue is on my side as you can check the network tab of your browser and see the redirect is 302...

Maybe you've got a proxy/cdn or other service that's doing a redirect before your own rules are run ? Maybe try removing or altering your rules to see if it has an effect.

If you want me to investigate deeper you'll have to tell me which url you're having issues with (You can contact me via email or Discord if you want to keep it private). I guess it's the .de website scanned a few hours ago.

PS: just fixed an issue that broke the whole report if your website returns errors when my bot tries to access the composer files. The fix has the side effect or not displaying malicious access on old reports anymore. But it will be back on every new scan. Even if you don't report the errors to me I still browse through hidden reports to see if you ran into issues and fix them for everybody else ?

clarkwinkelmann

Sorry not sorry to the owner of the forum that's listening but not answering on HTTPS and causing their whole scan to time out and fail ?

Joking aside, I've now applied sane timeouts to the requests so if the server isn't answering HTTP or HTTPS calls it does not make the whole scan timeout ?

clarkwinkelmann

Still hot: ? now showing extension versions and request log.

Also improved error messages and limited websites to a single slot in the recent scans.

Extension versions

The Lab now attempts to guess the version of the version installed on a forum. It is currently based only on the javascript content of the extension, so if the javascript didn't change between versions of an extension, it won't know for sure. That's why a range of versions is shown for some extensions.

This new evil scan method allows the scanner to detect some admin-only extensions by reading the admin javascript file ?

Now you will probably see some duplicate extensions. (one being the right one, the other not being installed on your forum). This happens if an extension was forked without being modified (which by the way isn't allowed by Packagist rules, you evil coders) or if an extension was deprecated but the new one is still identical to the previous one. I can manually blacklist those so they don't show up in the scans.

Due to the complexity of extracting the information I need from minified javascript files, there are some extensions that don't show any version number. Don't hesitate to report any extension that's not appearing (in particular if it was visible previous to this update).

If the extension version was found and is for sure out of date, an indicator will appear in the extension listing to indicate the new version. If no version was found for an extension, the latest available version is written beside it.

Request log

Under the scan you'll find the log of all requests done by the Lab to display that report, along with the headers and body of the response. (may be truncated) I hope this will help you debug (or spy) more accurately !

Happy scanning !

0E800

clarkwinkelmann

https://keys-daggers.org == A+

Thank you for excellent tool. I came up a long way from a D rating.

clarkwinkelmann

0E800 ?

Sorry everybody who scanned their forums today, there was an issue with the last update which rendered an empty list of extensions ? A fix is being deployed as I speak (type ?).

MikeJones

Just launched my first Flarum and am super excited about it! ( https://www.seekadventure.net ), feel free to join and discuss if you like ;-)

Anywho saw your tool and am using it to clean up my site before I start sending it out to the masses. I could use some pointers on what some of the warnings mean. I figured out the HSTS and got that working, now I need CSP and vendor, storage and composer files help.

Just looking to be pointed in the right direction!

clarkwinkelmann

I used the best descriptions I could come up with for the various warnings, but I expect they can be greatly improved. Please let me know if you find a better wording.

MikeJones What I could add is a link to the official documentation. The 3 "security" warnings should not happen with Apache because the included .htaccess prevents them. With nginx, the example config was recently fixed to prevent them as well. For any other webserver the official doc doesn't cover it and you need to find the needed rules to fix them. It's about blocking access to those files, because if anybody can access them by writing the filename in the url, then they could access private data or run untrusted scripts.

Regarding CSP, it's an optional thing. If you scroll up this discussion you'll find links to other discussions here about CSP.

Hope this helps ?

MikeJones

clarkwinkelmann It's about blocking access to those files, because if anybody can access them by writing the filename in the url, then they could access private data or run untrusted scripts.

Whats the best way to block access?

clarkwinkelmann

MikeJones from the headers returned by your server, it seems you are running nginx.

The following rule from the example documentation takes care of that. Make sure you're using it in your own configuration.

location ~* ^/(composer\.(json|lock)|config\.php|flarum|storage|vendor) {
    deny all;
    return 404;
}

clarkwinkelmann

New features coming to the lab !

I'm now also analyzing extensions themselves. Developers don't have to do anything, new extensions and new versions are automatically fetched and added to the list (once per day for now). Right now only versions hosted on GitHub benefit from the full features.

I've started work on a first feature which tracks translations coverage. The lab will display:

Whether the translation files are valid YAML (most format errors are generated by the Symfony Yaml library)
Which translations are part of an extension
Which extensions provide translations for other extensions
A rough idea of the current translation coverage in other languages (with English as the reference)

The UI is not very user-friendly for now, I have plans to improve it.

You'll see that duplicates for each version of a language pack that translates an extension are currently shown with their own line in the translations table... This will also be improved.

Go to https://lab.migratetoflarum.com/extensions to browse extensions and their analysis.

Let me know what you think ?

Ralkage

clarkwinkelmann this helped me identify a locale issue with Polls ?

Thank you for such a magnificent tool, CLARK!!!

ganuonglachanh

Amazing ??

clarkwinkelmann

Ralkage glad it helps. As you can see from the screenshot it also identified multiple issues with Bazaar.

Like for example we've merged an it language file (probably without actually testing it) and it can't even be parsed by Symfony Yaml parser ?

Also sometimes the identation is not correct and you end up not translating the strings you expect. Happened with the german file for Bazaar as well. I want to try to implement a real coverage tool (not just based on the total number of strings, but actual strings) so these issues can be identified.

I'm also planning to add some kind of notification feature in the future so you could subscribe to website or extension scan warnings. This might be a paid feature so it supports the hosting for the lab.

clarkwinkelmann

I think I've just identified a big contributor to the mysterious timeouts that have been happening lately.

I was using regular GET requests for security checks. One of my easy targets is the log file of Flarum, which always has the same name and is very likely to exist.

The problem was that when people did expose their log files, it was often megabytes in size and downloading it caused the request to exceed its allowed time. It both impacted the security rating (a request error is considered good when testing for exposed files) and was a big contributor towards the total run time of the scan, causing the whole scan to time out in some cases.

I've now switched all security checks to using HEAD requests. I didn't need the file content anyway. This will also prevent me from accidentally storing entire sensitive log files and exposing them publicly via the lab API...

The fix is now deployed. As always let me know if your scans time out or behave in a strange manner, there's probably something I can fix ?

luceos

clarkwinkelmann interesting how such a small change has such huge effects. ?

clarkwinkelmann

Lab update !

There is now a hall of fame on the homepage, showing the 5 most recent "A" ratings. I wasn't sure if it made sense, but as a few "bad" reviews are staying in the "recent" tab for weeks this will lighten the homepage a bit ✨

Also I fixed the annoying fact that the lab didn't correctly handle a discussion/tag/profile url and was complaining about a wrong Flarum base url. Now if you paste an url that looks like a Flarum sub-page, the lab will do an extra check to see if you really installed Flarum in a subfolder named like that or if it is a Flarum sub-page, in which case the sub-path will be removed to scan the actual Flarum home page.

I'm totally doing this just to have a valid reason to bump the thread ?

jordanjay29

clarkwinkelmann Is there a way to keep a scan out of the public stats?

« Previous Page Next Page »