Reject unsupported HTTP Message Signatures #7918
No reviewers
Labels
No labels
AP C2S
AdminAPI
Breaking API
Breaks existing config
Check if still valid
Data Protection
Do not merge
Document in the changelog
Doing
Feature Request / Enhancement
MastoAPI
NL2
NL4
OStatus
OTP Releases
Refactor
Security
To Do
TwitterAPI
bug
complicated
confirmed
deps
discussion
documentation
easy
feature: to be merged in stable
fix: to be merged in stable
incident
needs to be backported to maint
needs-changes
needs-info
needs-review
performance
regression
unclear
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pleroma/pleroma!7918
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "activitypub-bot-federation"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Testing
mix format --check-formatted lib/pleroma/web/activity_pub/activity_pub_controller.ex test/pleroma/web/activity_pub/activity_pub_controller_test.exsgit diff --checkpodman compose -f compose.yml up --build --abort-on-container-exit --exit-code-from activitypub-bot-testmix test test/pleroma/web/activity_pub/activity_pub_controller_test.exs:760 test/pleroma/web/activity_pub/activity_pub_controller_test.exs:797Review
WIP: Reject unsupported HTTP Message Signaturesto Reject unsupported HTTP Message Signatures@ -384,0 +395,4 @@defp cavage_signature?(conn) doconn|> Plug.Conn.get_req_header("signature")|> Enum.any?(&Regex.match?(~r/(^|,)\s*keyId\s*=/, &1))Probably should bail out on requests with multiple signature headers instead (more than one
signatureheader, notsignatureandsignature-input).can you elaborate on that?
HTTP has no issue with sending/receiving a request that has multiple headers with the same name and different content.
Plug.Conn.get_req_headerwill return you a list of all values for headers with that name. Similarlyhttp_signaturesusesEnum.intoon theconn.req_headerswhich is a List of Tuples to get the headers into a Map.Enum.intohas the side-effect where given input with the same key multiple times, only the last one occurrence is returned.So above we are checking whether any
signatureheader matches the regex, meanwhilehttp_signaturesmight process only the last one which might not have matched the regex and fail. This is not an issue now, but might become one in the future if more processing is added for some reason.In general processing requests with the same header multiple times is discouraged. The ensure host plug already bails out on multiple
Hostheaders, because you cannot be sure whether the request is intended for you at that point. Check first one and it is, check the second one and it might not. With signatures, the first one might be valid, the second one might not. And there's no reason why a request should have twosignatureheaders besides something funky is going on.