aboutsummaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)AuthorFilesLines
2025-03-31lib/anubis: actually check the result with the correct difficulty (#180)Henri Vasserman2-11/+84
* cmd/anubis actually check the result with the correct difficulty * chore: changelog * test(cmd/anubis): make test check for difficulty * lib: add regression test for CVE-2025-24369 Signed-off-by: Xe Iaso <me@xeiaso.net> * bump VERSION and CHANGELOG Tracks #181 Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-30Fix: Correct typo in challenge page title (main) (#174)Jason Cameron1-1/+1
- Fixed a typo in the challenge page title, removing an unnecessary backslash. - Updated the index page title to "Making sure you're not a bot!". Signed-off-by: Jason Cameron <git@jasoncameron.dev>
2025-03-29Debug tool for benchmarking proof-of-work algorithms (#155)jae beller2-1/+12
* cmd/anubis: add a debug option for benchmarking hashrate Having the ability to benchmark different proof-of-work implementations is useful for extending Anubis. This adds a flag `--debug-benchmark-js` (and its associated environment variable `DEBUG_BENCHMARK_JS`) for serving a tool to do so. Internally, a there is a new policy action, "DEBUG_BENCHMARK", which serves the benchmarking tool instead of a challenge. The flag then replaces all bot rules with a special rule matching every request to that action. The benchmark page makes heavy use of inline styles, because currently all global styles are shared across all pages. This could be fixed, but I wanted to avoid major changes to the templates. * web/js: add signal for aborting an active proof-of-work algorithm Both proof-of-work algorithms now take an optional `AbortSignal`, which immediately terminates all workers and returns `false` if aborted before the challenge is complete. * web/js: add algorithm comparison to the benchmark page "Compare:" is added to the benchmark page for testing the relative performance between two algorithms. Since benchmark runs generally have high variance, it may take a while for the averages to converge on a stable difference. --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-29Add periodic cleanup job for DecayMap (#8) (#158)Jason Cameron1-0/+4
* Add periodic cleanup job for DecayMap see https://github.com/TecharoHQ/anubis/issues/8 * Refactor: Improve DecayMap cleanup tests and add Len method - Refactored DecayMap cleanup tests to use the new Len method for more precise assertions. - Added a Len method to DecayMap to retrieve the number of entries. - Simplified conditional checks in Get method. * chore(changelog): add entry * fix(tests): Use Impl.expire for decaymap cleanup Signed-off-by: Jason Cameron <git@jasoncameron.dev> --------- Signed-off-by: Jason Cameron <git@jasoncameron.dev>
2025-03-29Add middleware to set Cache-Control header for challenge HTML (#132)Jason Cameron1-5/+8
* Add middleware to set Cache-Control header for challenge HTML * Add `NoStoreCache` middleware function in `internal/headers.go` to set Cache-Control: no-store header * Apply `NoStoreCache` middleware in `cmd/anubis/main.go` to set Cache-Control header for challenge HTML * docs: Add no-cache header information for challenge page * docs: Update changelog to reflect no-store Cache-Control header addition for challenge page * refactor: rename variable for clarity and update caching middleware in RenderIndex * chore: move changes to the unreleased section Signed-off-by: Jason Cameron <git@jasoncameron.dev> --------- Signed-off-by: Jason Cameron <jasoncameron.all@gmail.com> Signed-off-by: Jason Cameron <git@jasoncameron.dev>
2025-03-28Hide directory browsing on the static content (#85)Henri Vasserman1-1/+1
* Hide directory browsing on the static content * update changelog
2025-03-28Change how to make Anubis work without a reverse proxy (#86)Henri Vasserman1-1/+1
* Change how to make Anubis work without a reverse proxy * Apply suggestions from code review Co-authored-by: Xe Iaso <me@xeiaso.net> Signed-off-by: Henri Vasserman <henv@hot.ee> * add support for unix sockets. * add env var docs * lib: fix tests Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Henri Vasserman <henv@hot.ee> Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-27Apply bits of the cookie settings PR one by one (#140)Xe Iaso3-33/+124
Enables uses to change the cookie domain and partitioned flags. Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-26Revert "lib/anubis: support setting extended cookie flags (#120)" (#134)Xe Iaso3-125/+41
This reverts commit e7cbd349f3ff96788dc7a8540d29808ca72e1c44.
2025-03-26lib/anubis: support setting extended cookie flags (#120)Xe Iaso3-41/+125
* lib/anubis: support setting extended cookie flags Signed-off-by: Xe Iaso <me@xeiaso.net> * lib: use cookie name consistently Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-25cmd/anubis: allow setting key bytes in flag/envvar (#97)Xe Iaso1-5/+10
* cmd/anubis: allow setting key bytes in flag/envvar Docs are updated to generate a random key on load and when people press the recycle button. Signed-off-by: Xe Iaso <me@xeiaso.net> * review feedback fixups Signed-off-by: Xe Iaso <me@xeiaso.net> * Update cmd/anubis/main.go Signed-off-by: Xe Iaso <me@xeiaso.net> * Apply suggestions from code review Co-authored-by: Ryan Cao <70191398+ryanccn@users.noreply.github.com> Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Ryan Cao <70191398+ryanccn@users.noreply.github.com>
2025-03-25Linting and staticcheck fixes. (#101)Yulian Kuncheff3-14/+9
* Fix linting and staticcheck issues * Add changelog update * Remove SetNext
2025-03-23lib: fix default difficulty (#96)Xe Iaso2-2/+83
Before this did not respect the difficulty flag and instead used difficulty 4. This has been fixed. Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-22Refactor and split out things into cmd and lib (#77)Yulian Kuncheff15-0/+1270
* Refactor anubis to split business logic into a lib, and cmd to just be direct usage. * Post-rebase fixes. * Update changelog, remove unnecessary one. * lib: refactor this This is mostly based on my personal preferences for how Go code should be laid out. I'm not sold on the package name "lib" (I'd call it anubis but that would stutter), but people are probably gonna import it as libanubis so it's likely fine. Packages have been "flattened" to centralize implementation with area of concern. This goes against the Java-esque style that many people like, but I think this helps make things simple. Most notably: the dnsbl client (which is a hack) is an internal package until it's made more generic. Then it can be made external. I also fixed the logic such that `go generate` works and rebased on main. * internal/test: run tests iff npx exists and DONT_USE_NETWORK is not set Signed-off-by: Xe Iaso <me@xeiaso.net> * internal/test: install deps Signed-off-by: Xe Iaso <me@xeiaso.net> * .github/workflows: verbose go tests? Signed-off-by: Xe Iaso <me@xeiaso.net> * internal/test: sleep 2 Signed-off-by: Xe Iaso <me@xeiaso.net> * internal/test: nix this test so CI works Signed-off-by: Xe Iaso <me@xeiaso.net> * internal/test: warmup per browser? Signed-off-by: Xe Iaso <me@xeiaso.net> * internal/test: disable for now :( Signed-off-by: Xe Iaso <me@xeiaso.net> * lib/anubis: do not apply bot rules if address check fails Closes #83 --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-01 11:26:14 +0000