You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "kys1230 (via GitHub)" <gi...@apache.org> on 2024/08/13 07:53:13 UTC
[PR] fix: plugins cors allow_origins is "**" work does not meet expectations [apisix]
kys1230 opened a new pull request, #11498:
URL: https://github.com/apache/apisix/pull/11498
### Description
Resolved an issue where the cross-origin plugin did not function correctly when the plugin configuration allow_origins = "**" and an exceptional request header Origin contained a comma (",").
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [ ] I have added tests corresponding to this change
- [ ] I have updated the documentation to reflect this change
- [ ] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: plugins cors allow_origins is "**" work does not meet expectations [apisix]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #11498: fix: plugins cors allow_origins is "**" work does not meet expectations
URL: https://github.com/apache/apisix/pull/11498
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: plugins cors allow_origins is "**" work does not meet expectations [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on PR #11498:
URL: https://github.com/apache/apisix/pull/11498#issuecomment-2373886575
I'm not a cors expert but
> When the values of the Origin for subsequent normal requests do not equal the values obtained by splitting the malicious request's Origin by ',', the cross-origin response headers will not be returned
where is this check performed?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: plugins cors allow_origins is "**" work does not meet expectations [apisix]
Posted by "kys1230 (via GitHub)" <gi...@apache.org>.
kys1230 commented on PR #11498:
URL: https://github.com/apache/apisix/pull/11498#issuecomment-2309133675
Is there anything else I need to modify?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: plugins cors allow_origins is "**" work does not meet expectations [apisix]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #11498:
URL: https://github.com/apache/apisix/pull/11498#issuecomment-2497499440
This pull request has been marked as stale due to 60 days of inactivity. It will be closed in 4 weeks if no further activity occurs. If you think that's incorrect or this pull request should instead be reviewed, please simply write any comment. Even if closed, you can still revive the PR at any time or discuss it on the dev@apisix.apache.org list. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: plugins cors allow_origins is "**" work does not meet expectations [apisix]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #11498:
URL: https://github.com/apache/apisix/pull/11498#issuecomment-2564286281
This pull request/issue has been closed due to lack of activity. If you think that is incorrect, or the pull request requires review, you can revive the PR at any time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: plugins cors allow_origins is "**" work does not meet expectations [apisix]
Posted by "kys1230 (via GitHub)" <gi...@apache.org>.
kys1230 commented on PR #11498:
URL: https://github.com/apache/apisix/pull/11498#issuecomment-2286350170
Please pay attention to this issue, as it can lead to a malicious request that affects the cross-origin response of other normal requests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: plugins cors allow_origins is "**" work does not meet expectations [apisix]
Posted by "kys1230 (via GitHub)" <gi...@apache.org>.
kys1230 commented on PR #11498:
URL: https://github.com/apache/apisix/pull/11498#issuecomment-2290670482
In order to ensure that allow_credential=true does not return '*', the code has been revised.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: plugins cors allow_origins is "**" work does not meet expectations [apisix]
Posted by "kys1230 (via GitHub)" <gi...@apache.org>.
kys1230 commented on PR #11498:
URL: https://github.com/apache/apisix/pull/11498#issuecomment-2290665983
I tried Test::nginx but couldn't get it to run. I'll briefly describe the plugins I used and the reproduction method.
The plugin I used is the CORS plugin with the following configuration.
```json
{
"uri": "/*",
"name": "kystest",
"methods": [
"GET",
"POST",
"PUT",
"DELETE",
"PATCH",
"HEAD",
"OPTIONS",
"CONNECT",
"TRACE",
"PURGE"
],
"host": "kystest.a.b",
"plugins": {
"cors": {
"_meta": {
"disable": false
},
"allow_credential": true,
"allow_headers": "**",
"allow_methods": "**",
"allow_origins": "**",
"expose_headers": "**",
"max_age": 5
}
},
"upstream_id": "438941858735850233",
"status": 1
}
```
Normal request:
```bash
# once
$ curl -s --resolve kystest.a.b:9080:10.41.0.12 -I -XOPTIONS -H 'Origin: http://a.b.c' http://kystest.a.b:9080
HTTP/1.1 200 OK
Date: Thu, 15 Aug 2024 05:15:19 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
X-Request-ID: b03d213c-0393-4719-8aeb-26a4a6ed910c
Access-Control-Allow-Origin: http://a.b.c
Vary: Origin
Access-Control-Allow-Methods: GET,POST,PUT,DELETE,PATCH,HEAD,OPTIONS,CONNECT,TRACE
Access-Control-Max-Age: 5
Access-Control-Expose-Headers: **
Access-Control-Allow-Credentials: true
# multiple
for i in {0..99}; do curl -s --resolve kystest.a.b:9080:10.41.0.12 -I -XOPTIONS -H 'Origin: http://a.b.c' http://kystest.a.b:9080 | grep -q 'Access-Control' && echo ok || echo no ; done | sort | uniq -c
100 ok
```
malicious request is an erroneous request
If the Origin maliciously passes in content with a ',', it will trigger this issue. When the values of the Origin for subsequent normal requests do not equal the values obtained by splitting the malicious request's Origin by ',', the cross-origin response headers will not be returned
Taking http://a.b.c and http://b.c.d as examples, if the Origin of subsequent requests does not equal http://a.b.c or http://b.c.d, this issue may occur with a certain probability. This probability depends on the number of nginx workers. If malicious requests are repeatedly called multiple times, once all workers have processed the malicious requests, this issue will consistently reproduce.
```bash
$ curl -s --resolve kystest.a.b:9080:10.41.0.12 -I -XOPTIONS -H 'Origin: http://a.b.c,http://b.c.d' http://kystest.a.b:9080
HTTP/1.1 200 OK
Date: Thu, 15 Aug 2024 05:20:53 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
X-Request-ID: 2417dd05-00cf-43fb-b7cc-cbef7176b044
$ for i in {0..99}; do curl -s --resolve kystest.a.b:9080:10.41.0.12 -I -XOPTIONS -H 'Origin: http://a.b.e' http://kystest.a.b:9080 | grep -q 'Access-Control' && echo ok || echo no ; done | sort | uniq -c
29 no
71 ok
# Call the malicious request multiple times
$ for i in {0..99}; do curl -s --resolve kystest.a.b:9080:10.41.0.12 -I -H 'Origin: http://a.b.c,http://b.c.d' -XOPTIONS http://kystest.a.b:9080 | grep -q 'Access-Control' && echo ok || echo no ; done | sort | uniq -c
100 no
# At this time, all normal requests will be affected.
for i in {0..99}; do curl -s --resolve kystest.a.b:9080:10.41.0.12 -I -XOPTIONS -H 'Origin: http://a.b.e' http://kystest.a.b:9080 | grep -q 'Access-Control' && echo ok || echo no ; done | sort | uniq -c
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org