You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@couchdb.apache.org by mayya-sharipova <gi...@git.apache.org> on 2015/09/02 19:40:02 UTC
[GitHub] couchdb-couch pull request: check POST requests for valid json hea...
GitHub user mayya-sharipova opened a pull request:
https://github.com/apache/couchdb-couch/pull/95
check POST requests for valid json header
validate that all POST requests with json body must have also have valid
json header: {"Content-Type": "application/json"}
This ensures a basic protection against CSRF
JIRA: COUCHDB-2775
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/cloudant/couchdb-couch 2775-post-valid-json-header
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/couchdb-couch/pull/95.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #95
----
commit 94894554ab1f3e6f9fda5b1eac4fa8af9501ac0d
Author: Mayya Sharipova <ma...@ca.ibm.com>
Date: 2015-09-02T17:33:29Z
check POST requests for valid json header
validate that all POST requests with json body must have also have valid
json header: {"Content-Type": "application/json"}
This ensures a basic protection against CSRF
JIRA: COUCHDB-2775
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] couchdb-couch pull request: check POST requests for valid json hea...
Posted by rnewson <gi...@git.apache.org>.
Github user rnewson commented on a diff in the pull request:
https://github.com/apache/couchdb-couch/pull/95#discussion_r38640422
--- Diff: src/couch_httpd_misc_handlers.erl ---
@@ -185,6 +185,7 @@ handle_config_req(#httpd{method='GET', path_parts=[_, Section, Key]}=Req) ->
end;
% POST /_config/_reload - Flushes unpersisted config values from RAM
handle_config_req(#httpd{method='POST', path_parts=[_, <<"_reload">>]}=Req) ->
+ couch_httpd:validate_ctype(Req, "application/json"),
--- End diff --
hm, ok then.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] couchdb-couch pull request: check POST requests for valid json hea...
Posted by rnewson <gi...@git.apache.org>.
Github user rnewson commented on the pull request:
https://github.com/apache/couchdb-couch/pull/95#issuecomment-137423134
+1
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] couchdb-couch pull request: check POST requests for valid json hea...
Posted by asfgit <gi...@git.apache.org>.
Github user asfgit closed the pull request at:
https://github.com/apache/couchdb-couch/pull/95
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] couchdb-couch pull request: check POST requests for valid json hea...
Posted by rnewson <gi...@git.apache.org>.
Github user rnewson commented on a diff in the pull request:
https://github.com/apache/couchdb-couch/pull/95#discussion_r38561396
--- Diff: src/couch_httpd_misc_handlers.erl ---
@@ -185,6 +185,7 @@ handle_config_req(#httpd{method='GET', path_parts=[_, Section, Key]}=Req) ->
end;
% POST /_config/_reload - Flushes unpersisted config values from RAM
handle_config_req(#httpd{method='POST', path_parts=[_, <<"_reload">>]}=Req) ->
+ couch_httpd:validate_ctype(Req, "application/json"),
--- End diff --
this one doesn't take a request body.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] couchdb-couch pull request: check POST requests for valid json hea...
Posted by mayya-sharipova <gi...@git.apache.org>.
Github user mayya-sharipova commented on a diff in the pull request:
https://github.com/apache/couchdb-couch/pull/95#discussion_r38576507
--- Diff: src/couch_httpd_misc_handlers.erl ---
@@ -185,6 +185,7 @@ handle_config_req(#httpd{method='GET', path_parts=[_, Section, Key]}=Req) ->
end;
% POST /_config/_reload - Flushes unpersisted config values from RAM
handle_config_req(#httpd{method='POST', path_parts=[_, <<"_reload">>]}=Req) ->
+ couch_httpd:validate_ctype(Req, "application/json"),
--- End diff --
Thanks for comments. For consistency reason, I left validate_ctype in _reload request, also reading the body: _ = couch_httpd:body(Req).
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] couchdb-couch pull request: check POST requests for valid json hea...
Posted by kxepal <gi...@git.apache.org>.
Github user kxepal commented on a diff in the pull request:
https://github.com/apache/couchdb-couch/pull/95#discussion_r38580130
--- Diff: src/couch_httpd_misc_handlers.erl ---
@@ -185,6 +185,7 @@ handle_config_req(#httpd{method='GET', path_parts=[_, Section, Key]}=Req) ->
end;
% POST /_config/_reload - Flushes unpersisted config values from RAM
handle_config_req(#httpd{method='POST', path_parts=[_, <<"_reload">>]}=Req) ->
+ couch_httpd:validate_ctype(Req, "application/json"),
--- End diff --
Oh, right, sorry, didn't notice it.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] couchdb-couch pull request: check POST requests for valid json hea...
Posted by kxepal <gi...@git.apache.org>.
Github user kxepal commented on a diff in the pull request:
https://github.com/apache/couchdb-couch/pull/95#discussion_r38564114
--- Diff: src/couch_httpd_misc_handlers.erl ---
@@ -185,6 +185,7 @@ handle_config_req(#httpd{method='GET', path_parts=[_, Section, Key]}=Req) ->
end;
% POST /_config/_reload - Flushes unpersisted config values from RAM
handle_config_req(#httpd{method='POST', path_parts=[_, <<"_reload">>]}=Req) ->
+ couch_httpd:validate_ctype(Req, "application/json"),
--- End diff --
_compact and _ensure_full_commit requests doesn't take any body as well, but they also ensures in JSON mimetype. So it's for consistent behaviour. However, need to forcely read the body `_ = couch_httpd:body(Req),` to prevent request hangs.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] couchdb-couch pull request: check POST requests for valid json hea...
Posted by rnewson <gi...@git.apache.org>.
Github user rnewson commented on the pull request:
https://github.com/apache/couchdb-couch/pull/95#issuecomment-137183645
+1 after fixing that one superfluous check.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---