Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

http: Relaxed sanitization of referer header to allow relative URLs. #25947

Merged
merged 11 commits into from
Mar 28, 2023
Merged

http: Relaxed sanitization of referer header to allow relative URLs. #25947

merged 11 commits into from
Mar 28, 2023

Conversation

briansonnenberg
Copy link
Contributor

Tightened sanitization to reject URLs containing userinfo or fragment components, as per RFC.

Commit Message:
Additional Description:
Risk Level: Low
Testing: Included
Docs Changes: Included
Release Notes: Included
Platform Specific Features: None
Fixes #25442

@RyanTheOptimist
Copy link
Contributor

/assign @yanavlasov

yanavlasov
yanavlasov reviewed Mar 8, 2023
View reviewed changes
Copy link
Contributor

@yanavlasov yanavlasov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/wait-any

bazel/external/http_parser/http_parser.c Outdated Show resolved Hide resolved
yanavlasov
yanavlasov requested changes Mar 13, 2023
View reviewed changes
Copy link
Contributor

@yanavlasov yanavlasov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/wait

source/common/http/utility.h Show resolved Hide resolved
@yanavlasov
Copy link
Contributor

Thanks. Looks like format is not happy.

I'm also getting a second maintainer opinion on the need for a runtime flag to be able to revert this behavior during the deprecation interval, since it is a user visible behavior change (even though the original behavior was incorrect).

/wait

@briansonnenberg briansonnenberg force-pushed the brian-referer branch 2 times, most recently from 2ff0984 to 5922fe7 Compare March 17, 2023 17:22
@yanavlasov
Copy link
Contributor

@briansonnenberg Other maintainers agree that since this is a user visible change, it requires a runtime flag protection per policy. Please add this flag protection, here is an example: https://github.com/envoyproxy/envoy/pull/25060/files

@yanavlasov
Copy link
Contributor

/wait-any

@repokitteh-read-only
Copy link

CC @envoyproxy/runtime-guard-changes: FYI only for changes made to (source/common/runtime/runtime_features.cc).

🐱

Caused by: #25947 was synchronize by briansonnenberg.

see: more, trace.

@briansonnenberg
http: Relaxed sanitization of referer header to allow relative URLs. …
e7253d8 
…Tightened sanitization to reject URLs containing userinfo or fragment components

Signed-off-by: Brian Sonnenberg <bsonnenberg@google.com>
@briansonnenberg
pulled the logic out of http-parser.
0103dd9 
Signed-off-by: Brian Sonnenberg <bsonnenberg@google.com>
@briansonnenberg
Removed http_parser.* changes
bbddeff 
Signed-off-by: Brian Sonnenberg <bsonnenberg@google.com>
@briansonnenberg
Added some unit tests for the isValidRefererValue function.
681a5e4 
Signed-off-by: Brian Sonnenberg <bsonnenberg@google.com>
@briansonnenberg
Added missing period in changelogs
6799c69 
Signed-off-by: Brian Sonnenberg <bsonnenberg@google.com>
@briansonnenberg
Formatting
3192b57 
Signed-off-by: Brian Sonnenberg <bsonnenberg@google.com>
@briansonnenberg
Added runtime guard and tests.
3067e06 
Signed-off-by: Brian Sonnenberg <bsonnenberg@google.com>
@briansonnenberg
Updated changelog with runtime guard.
b5816c9 
Signed-off-by: Brian Sonnenberg <bsonnenberg@google.com>
@briansonnenberg
Formatting
c262434 
Signed-off-by: Brian Sonnenberg <bsonnenberg@google.com>
@briansonnenberg
alphabetize runtime guard
fe83fcc 
Signed-off-by: Brian Sonnenberg <bsonnenberg@google.com>
@briansonnenberg
Lint fixes.
b472bc3 
Signed-off-by: Brian Sonnenberg <bsonnenberg@google.com>
@briansonnenberg
Copy link
Contributor Author

Can anyone elaborate on these test failures? It seems like different, unrelated tests are failing each time. Rebasing fixed a number of them, as I noticed some commits related to flaky tests recently went in.

@kyessenov
Copy link
Contributor

@briansonnenberg Please don't force push as it erases the comment history. Some integration tests are flakey, and you can use "/retest" command to deflake them. Merging main can also help sometimes if someone fixed the flakes.

@briansonnenberg
Copy link
Contributor Author

/retest

@repokitteh-read-only
Copy link

Retrying Azure Pipelines:
Retried failed jobs in: envoy-presubmit

🐱

Caused by: a #25947 (comment) was created by @briansonnenberg.

see: more, trace.

@yanavlasov yanavlasov merged commit 08f9b9a into envoyproxy:main Mar 28, 2023
@briansonnenberg briansonnenberg deleted the brian-referer branch March 28, 2023 18:25
@barchw barchw mentioned this pull request Jul 18, 2023
Closed
6 tasks
@strekm strekm mentioned this pull request Jul 21, 2023
Closed
6 tasks
@alyssawilk alyssawilk mentioned this pull request Oct 23, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bencebeky bencebeky bencebeky left review comments

@kyessenov kyessenov kyessenov left review comments

@RyanTheOptimist RyanTheOptimist RyanTheOptimist left review comments

@yanavlasov yanavlasov yanavlasov approved these changes

Assignees

@yanavlasov yanavlasov

@RyanTheOptimist RyanTheOptimist

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

http: envoy rejects valid referer
5 participants
@briansonnenberg @RyanTheOptimist @yanavlasov @kyessenov @bencebeky