diff options
| author | Toby Simmons <toby@simmonsconsulting.com> | 2022-05-26 10:56:14 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-05-26 23:56:14 +0800 |
| commit | d54e153fc897249e0043a4b83a1125edd155486b (patch) | |
| tree | 095ab6a9e72bafc0a1dc56aada6b498aca9a35a5 /internal/context | |
| parent | e65071d3aa6820c267c2bab17f047e7c3a630da0 (diff) | |
csrf: sanitize token after reading from cookie (#6969)
Co-authored-by: Joe Chen <jc@unknwon.io>
Diffstat (limited to 'internal/context')
| -rw-r--r-- | internal/context/context.go | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/internal/context/context.go b/internal/context/context.go index ad30d55f..b9c8242a 100644 --- a/internal/context/context.go +++ b/internal/context/context.go @@ -22,6 +22,7 @@ import ( "gogs.io/gogs/internal/db" "gogs.io/gogs/internal/errutil" "gogs.io/gogs/internal/form" + "gogs.io/gogs/internal/lazyregexp" "gogs.io/gogs/internal/template" ) @@ -228,6 +229,11 @@ func (c *Context) ServeContent(name string, r io.ReadSeeker, params ...interface http.ServeContent(c.Resp, c.Req.Request, name, modtime, r) } +// csrfTokenExcludePattern matches characters that are not used for generating +// CSRF tokens, see all possible characters at +// https://github.com/go-macaron/csrf/blob/5d38f39de352972063d1ef026fc477283841bb9b/csrf.go#L148. +var csrfTokenExcludePattern = lazyregexp.New(`[^a-zA-Z0-9-_].*`) + // Contexter initializes a classic context for a request. func Contexter() macaron.Handler { return func(ctx *macaron.Context, l i18n.Locale, cache cache.Cache, sess session.Store, f *session.Flash, x csrf.CSRF) { @@ -276,8 +282,12 @@ func Contexter() macaron.Handler { } } - c.Data["CSRFToken"] = x.GetToken() - c.Data["CSRFTokenHTML"] = template.Safe(`<input type="hidden" name="_csrf" value="` + x.GetToken() + `">`) + // 🚨 SECURITY: Prevent XSS from injected CSRF cookie by stripping all + // characters that are not used for generating CSRF tokens, see + // https://github.com/gogs/gogs/issues/6953 for details. + csrfToken := csrfTokenExcludePattern.ReplaceAllString(x.GetToken(), "") + c.Data["CSRFToken"] = csrfToken + c.Data["CSRFTokenHTML"] = template.Safe(`<input type="hidden" name="_csrf" value="` + csrfToken + `">`) log.Trace("Session ID: %s", sess.ID()) log.Trace("CSRF Token: %v", c.Data["CSRFToken"]) |