USEFULL
/
gogs
mirror of https://github.com/gogs/gogs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

csrf: sanitize token after reading from cookie (#6969) 

Co-authored-by: Joe Chen <jc@unknwon.io>
pull/6972/head
Toby Simmons 2022-05-26 10:56:14 -05:00 committed by GitHub
parent e65071d3aa
commit d54e153fc8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
internal/context/context.go
View File

@ -22,6 +22,7 @@ import (
"gogs.io/gogs/internal/db"
"gogs.io/gogs/internal/errutil"
"gogs.io/gogs/internal/form"
"gogs.io/gogs/internal/lazyregexp"
"gogs.io/gogs/internal/template"
)
@ -228,6 +229,11 @@ func (c *Context) ServeContent(name string, r io.ReadSeeker, params ...interface
http.ServeContent(c.Resp, c.Req.Request, name, modtime, r)
}
// csrfTokenExcludePattern matches characters that are not used for generating
// CSRF tokens, see all possible characters at
// https://github.com/go-macaron/csrf/blob/5d38f39de352972063d1ef026fc477283841bb9b/csrf.go#L148.
var csrfTokenExcludePattern = lazyregexp.New(`[^a-zA-Z0-9-_].*`)
// Contexter initializes a classic context for a request.
func Contexter() macaron.Handler {
return func(ctx *macaron.Context, l i18n.Locale, cache cache.Cache, sess session.Store, f *session.Flash, x csrf.CSRF) {
@ -276,8 +282,12 @@ func Contexter() macaron.Handler {
}
}
c.Data["CSRFToken"] = x.GetToken()
c.Data["CSRFTokenHTML"] = template.Safe(`<input type="hidden" name="_csrf" value="` + x.GetToken() + `">`)
// 🚨 SECURITY: Prevent XSS from injected CSRF cookie by stripping all
// characters that are not used for generating CSRF tokens, see
// https://github.com/gogs/gogs/issues/6953 for details.
csrfToken := csrfTokenExcludePattern.ReplaceAllString(x.GetToken(), "")
c.Data["CSRFToken"] = csrfToken
c.Data["CSRFTokenHTML"] = template.Safe(`<input type="hidden" name="_csrf" value="` + csrfToken + `">`)
log.Trace("Session ID: %s", sess.ID())
log.Trace("CSRF Token: %v", c.Data["CSRFToken"])