fix: limit SW registration to content root
Introduces hardening proposed in: https://github.com/ipfs/go-ipfs/issues/4025#issuecomment-342250616 License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>
Marcin Rataj committed
Dec 17, 2019 at 02:11 UTC
455e49835500fb46053f68d1236a103d75db18df
2 files changed
+20
core/corehttp/gateway_handler.go
+13
@@ -8,6 +8,7 @@ import (
8
"net/http"
9
"net/url"
10
gopath "path"
11
+ "regexp"
12
"runtime/debug"
13
"strings"
14
"time"
@@ -151,6 +152,18 @@ func (i *gatewayHandler) getOrHeadHandler(w http.ResponseWriter, r *http.Request
152
ipnsHostname = true
153
}
154
155
+ // Service Worker registration request
156
+ if r.Header.Get("Service-Worker") == "script" {
157
+ // Disallow Service Worker registration on namespace roots
158
+ // https://github.com/ipfs/go-ipfs/issues/4025
159
+ matched, _ := regexp.MatchString(`^/ip[fn]s/[^/]+$`, r.URL.Path)
160
+ if matched {
161
+ err := fmt.Errorf("registration is not allowed for this scope")
162
+ webError(w, "navigator.serviceWorker", err, http.StatusBadRequest)
163
+ return
164
+ }
165
+ }
166
+
167
parsedPath := ipath.New(urlPath)
168
if err := parsedPath.IsValid(); err != nil {
169
webError(w, "invalid ipfs path", err, http.StatusBadRequest)
test/sharness/t0110-gateway.sh
+7
@@ -36,6 +36,13 @@ test_expect_success "GET IPFS path with explicit filename succeeds with proper h
36
grep -F \"Content-Disposition: inline; filename*=UTF-8''test%D1%82%D0%B5%D1%81%D1%82\" actual_headers
37
"
38
39
+# https://github.com/ipfs/go-ipfs/issues/4025#issuecomment-342250616
40
+test_expect_success "GET for Service Worker registration outside of an IPFS content root errors" "
41
+ curl -H 'Service-Worker: script' -svX GET 'http://127.0.0.1:$port/ipfs/$HASH?filename=sw.js' > curl_sw_out 2>&1 &&
42
+ grep 'HTTP/1.1 400 Bad Request' curl_sw_out &&
43
+ grep 'navigator.serviceWorker: registration is not allowed for this scope' curl_sw_out
44
+"
45
+
46
test_expect_success "GET IPFS path output looks good" '
47
test_cmp expected actual &&
48
rm actual