Mercurial > kallithea
changeset 5811:9b74296e6af6 stable
auth: further sanitize requests to prevent GET CSRF (CVE-2016-3691)
Routes allows GET requests to override the HTTP method, which breaks
the Kallithea CSRF protection (which only applies to POST requests).
This commit blocks such GET request, preventing CSRF attacks.
| author | Søren Løvborg <sorenl@unity3d.com> |
|---|---|
| date | Tue, 19 Apr 2016 18:02:56 +0200 |
| parents | 81057be7a5c1 |
| children | a84d40e9481f |
| files | kallithea/lib/auth.py |
| diffstat | 1 files changed, 10 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/kallithea/lib/auth.py Tue Apr 19 16:57:38 2016 +0200 +++ b/kallithea/lib/auth.py Tue Apr 19 18:02:56 2016 +0200 @@ -766,6 +766,16 @@ if request.method not in ['GET', 'HEAD', 'POST', 'PUT']: return abort(405) + # Also verify the _method override. This is only permitted in POST + # requests, and can specify PUT or DELETE. + _method = request.params.get('_method') + if _method is None: + pass # no override, no problem + elif request.method == 'POST' and _method.upper() in ['PUT', 'DELETE']: + pass # permitted override + else: + raise HTTPMethodNotAllowed() + # Make sure CSRF token never appears in the URL. If so, invalidate it. if secure_form.token_key in request.GET: log.error('CSRF key leak detected')