fix: limit SW registration to content root
Introduces hardening proposed in: https://github.com/ipfs/go-ipfs/issues/4025#issuecomment-342250616 License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>
Marcin Rataj committed
Dec 17, 2019 at 02:11 UTC
115b2ba6cdbf956abbf5711ea4befab25ff2555e
2 files changed
+20
core/corehttp/gateway_handler.go
+13
@@ -9,6 +9,7 @@ import (
9
"net/url"
10
"os"
11
gopath "path"
12
+ "regexp"
13
"runtime/debug"
14
"strings"
15
"time"
@@ -155,6 +156,18 @@ func (i *gatewayHandler) getOrHeadHandler(w http.ResponseWriter, r *http.Request
156
ipnsHostname = true
157
}
158
159
+ // Service Worker registration request
160
+ if r.Header.Get("Service-Worker") == "script" {
161
+ // Disallow Service Worker registration on namespace roots
162
+ // https://github.com/ipfs/go-ipfs/issues/4025
163
+ matched, _ := regexp.MatchString(`^/ip[fn]s/[^/]+$`, r.URL.Path)
164
+ if matched {
165
+ err := fmt.Errorf("registration is not allowed for this scope")
166
+ webError(w, "navigator.serviceWorker", err, http.StatusBadRequest)
167
+ return
168
+ }
169
+ }
170
+
171
parsedPath := ipath.New(urlPath)
172
if err := parsedPath.IsValid(); err != nil {
173
webError(w, "invalid ipfs path", err, http.StatusBadRequest)
test/sharness/t0110-gateway.sh
+7
@@ -36,6 +36,13 @@ test_expect_success "GET IPFS path with explicit filename succeeds with proper h
36
grep -F \"Content-Disposition: inline; filename*=UTF-8''test%D1%82%D0%B5%D1%81%D1%82\" actual_headers
37
"
38
39
+# https://github.com/ipfs/go-ipfs/issues/4025#issuecomment-342250616
40
+test_expect_success "GET for Service Worker registration outside of an IPFS content root errors" "
41
+ curl -H 'Service-Worker: script' -svX GET 'http://127.0.0.1:$port/ipfs/$HASH?filename=sw.js' > curl_sw_out 2>&1 &&
42
+ grep 'HTTP/1.1 400 Bad Request' curl_sw_out &&
43
+ grep 'navigator.serviceWorker: registration is not allowed for this scope' curl_sw_out
44
+"
45
+
46
test_expect_success "GET IPFS path output looks good" '
47
test_cmp expected actual &&
48
rm actual