(tooling-trusted-releases) branch main updated: Forbid mutating navigations to the API and all mutating cross-site requests

[sb...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sbp pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git


The following commit(s) were added to refs/heads/main by this push:
     new cce31032 Forbid mutating navigations to the API and all mutating cross-site requests
cce31032 is described below

commit cce310329d0ac9061c418efccf7fc578ce584ba4
Author: Dave Fisher <da...@comcast.net>
AuthorDate: Tue Mar 3 07:47:35 2026 -0800

    Forbid mutating navigations to the API and all mutating cross-site requests
    
    * Validate sec-fetch headers
    
    * Update sec-fetch checks
    
    * Something broke in integration tests
    
    * Put back to double check
    
    * Change restrictions
    
    ---------
    
    Co-authored-by: Sean B. Palmer <se...@miscoranda.com>
---
 atr/server.py | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/atr/server.py b/atr/server.py
index da736e3b..bcb45517 100644
--- a/atr/server.py
+++ b/atr/server.py
@@ -525,6 +525,23 @@ def _app_setup_security_headers(app: base.QuartApp) -> None:
         ]
     )
 
+    @app.before_request
+    async def validate_sec_fetch_headers() -> None:
+        if quart.request.method not in ("GET", "HEAD", "OPTIONS"):
+            sec_fetch_mode = quart.request.headers.get("Sec-Fetch-Mode")
+            sec_fetch_site = quart.request.headers.get("Sec-Fetch-Site")
+
+            # Apart from PAT hashes and PII, all data in ATR is public
+            # Therefore we are only concerned here with non-GET API requests
+            if (sec_fetch_mode == "navigate") and quart.request.path.startswith("/api/"):
+                raise base.ASFQuartException(
+                    "Forbidden: non-GET/HEAD/OPTIONS browser navigation to API endpoint", errorcode=403
+                )
+
+            # This is in addition to our existing CSRF protection
+            if sec_fetch_site == "cross-site":
+                raise base.ASFQuartException("Forbidden: cross-site non-GET/HEAD/OPTIONS request", errorcode=403)
+
     # X-Content-Type-Options: nosniff is required by ASVS v5 3.4.4 (L2)
     # A strict Referrer-Policy is required by ASVS v5 3.4.5 (L2)
     # HSTS is required by ASVS v5 9.2.1 (L1)


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org