Bugzilla – Attachment 165076 Details for
Bug 36598
Add CSRF protection to Mojolicious apps
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36598: Prohibit CUD operations with safe HTTP methods (GET/HEAD/...)
Bug-36598-Prohibit-CUD-operations-with-safe-HTTP-m.patch (text/plain), 2.95 KB, created by
Matt Blenkinsop
on 2024-04-18 10:33:56 UTC
(
hide
)
Description:
Bug 36598: Prohibit CUD operations with safe HTTP methods (GET/HEAD/...)
Filename:
MIME Type:
Creator:
Matt Blenkinsop
Created:
2024-04-18 10:33:56 UTC
Size:
2.95 KB
patch
obsolete
>From 49025ae7378ef00522e6c63baca1e54fc6fdda7a Mon Sep 17 00:00:00 2001 >From: Julian Maurice <julian.maurice@biblibre.com> >Date: Mon, 15 Apr 2024 09:08:48 +0200 >Subject: [PATCH] Bug 36598: Prohibit CUD operations with safe HTTP methods > (GET/HEAD/...) > >Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> >--- > Koha/App/Plugin/CSRF.pm | 7 ++++++- > t/db_dependent/mojo/csrf.t | 18 ++++++++++++++++-- > 2 files changed, 22 insertions(+), 3 deletions(-) > >diff --git a/Koha/App/Plugin/CSRF.pm b/Koha/App/Plugin/CSRF.pm >index 0d2846ae53..b24fef655a 100644 >--- a/Koha/App/Plugin/CSRF.pm >+++ b/Koha/App/Plugin/CSRF.pm >@@ -62,7 +62,12 @@ sub register { > my ( $next, $c, $action, $last ) = @_; > > my $method = $c->req->method; >- if ( $method eq 'POST' || $method eq 'PUT' || $method eq 'DELETE' || $method eq 'PATCH' ) { >+ if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) { >+ my $op = $c->req->param('op'); >+ if ( $op && $op =~ /^cud-/ ) { >+ return $c->reply->exception('Wrong HTTP method')->rendered(400); >+ } >+ } else { > if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) { > return $c->reply->exception('Wrong CSRF token')->rendered(403); > } >diff --git a/t/db_dependent/mojo/csrf.t b/t/db_dependent/mojo/csrf.t >index 02b707301d..d52dd77b8c 100755 >--- a/t/db_dependent/mojo/csrf.t >+++ b/t/db_dependent/mojo/csrf.t >@@ -8,7 +8,7 @@ use Test::Mojo; > use Koha::Database; > > subtest 'CSRF - Intranet' => sub { >- plan tests => 4; >+ plan tests => 5; > > my $t = Test::Mojo->new('Koha::App::Intranet'); > >@@ -39,10 +39,17 @@ subtest 'CSRF - Intranet' => sub { > $t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) > ->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); > }; >+ >+ subtest 'GETting what should be POSTed should fail' => sub { >+ plan tests => 3; >+ >+ $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400) >+ ->content_like( qr/Wrong HTTP method/, 'Body contains "Wrong HTTP method"' ); >+ } > }; > > subtest 'CSRF - OPAC' => sub { >- plan tests => 4; >+ plan tests => 5; > > my $t = Test::Mojo->new('Koha::App::Opac'); > >@@ -73,4 +80,11 @@ subtest 'CSRF - OPAC' => sub { > $t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) > ->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); > }; >+ >+ subtest 'GETting what should be POSTed should fail' => sub { >+ plan tests => 3; >+ >+ $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400) >+ ->content_like( qr/Wrong HTTP method/, 'Body contains "Wrong HTTP method"' ); >+ } > }; >-- >2.37.1 (Apple Git-137.1)
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36598
:
164847
|
164848
|
164870
|
165075
|
165076
|
166094
|
166634
|
166673
|
166675
|
166727
|
166728
|
166729
|
166730
|
166731
|
166732
|
166733
|
171119
|
171120
|
171121
|
171122
|
171123
|
171124
|
171125