Onionr/src/httpapi/security/client.py

103 lines
4.2 KiB
Python
Raw Normal View History

2020-06-21 20:48:00 +00:00
"""Onionr - Private P2P Communication.
2020-08-26 08:25:43 +00:00
Process incoming requests to the client api server to validate
that they are legitimate and not DNSR/XSRF or other local adversary
2020-06-21 20:48:00 +00:00
"""
from ipaddress import ip_address
2020-06-21 20:48:00 +00:00
import hmac
2020-06-21 20:48:00 +00:00
from flask import Blueprint, request, abort, g
from httpapi import httpheaders
2020-06-21 20:48:00 +00:00
from . import pluginwhitelist
import config
import logger
2020-06-21 20:48:00 +00:00
"""
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
2020-06-21 20:48:00 +00:00
"""
2020-08-26 08:25:43 +00:00
# Be extremely mindful of this.
# These are endpoints available without a password
whitelist_endpoints = [
'www', 'staticfiles.homedata',
'staticfiles.sharedContent',
'staticfiles.friends', 'staticfiles.friendsindex', 'siteapi.site',
'siteapi.siteFile', 'staticfiles.onionrhome',
'themes.getTheme', 'staticfiles.onboarding', 'staticfiles.onboardingIndex']
remote_safe_whitelist = ['www', 'staticfiles']
public_remote_enabled = config.get('ui.public_remote_enabled', False)
public_remote_hostnames = config.get('ui.public_remote_hosts', [])
class ClientAPISecurity:
def __init__(self, client_api):
client_api_security_bp = Blueprint('clientapisecurity', __name__)
self.client_api_security_bp = client_api_security_bp
self.client_api = client_api
2020-08-26 08:25:43 +00:00
pluginwhitelist.load_plugin_security_whitelist_endpoints(
whitelist_endpoints)
@client_api_security_bp.before_app_request
def validate_request():
"""Validate request has set password & is the correct hostname."""
# For the purpose of preventing DNS rebinding attacks
if ip_address(client_api.host).is_loopback:
localhost = True
if request.host != '%s:%s' % \
(client_api.host, client_api.bindPort):
localhost = False
if not localhost and public_remote_enabled:
if request.host not in public_remote_hostnames:
logger.warn(
f'{request.host} not in {public_remote_hostnames}')
abort(403)
else:
if not localhost:
logger.warn(
f'Possible DNS rebinding attack by {request.host}')
abort(403)
# Static files for Onionr sites
2020-08-26 08:25:43 +00:00
if request.path.startswith('/site/'):
return
if request.endpoint in whitelist_endpoints:
return
2020-01-29 19:45:31 +00:00
try:
2020-08-26 08:25:43 +00:00
if not hmac.compare_digest(
request.headers['token'], client_api.clientToken):
if not hmac.compare_digest(
request.form['token'], client_api.clientToken):
2020-01-29 19:45:31 +00:00
abort(403)
except KeyError:
2020-08-26 08:25:43 +00:00
if not hmac.compare_digest(
request.form['token'], client_api.clientToken):
2020-01-29 19:45:31 +00:00
abort(403)
@client_api_security_bp.after_app_request
def after_req(resp):
# Security headers
resp = httpheaders.set_default_onionr_http_headers(resp)
2019-11-14 03:06:04 +00:00
if request.endpoint in ('siteapi.site', 'siteapi.siteFile'):
2020-08-26 08:25:43 +00:00
resp.headers['Content-Security-Policy'] = \
"default-src 'none'; style-src 'self' data: 'unsafe-inline'; img-src 'self' data:; media-src 'self' data:" # noqa
else:
2020-08-26 08:25:43 +00:00
resp.headers['Content-Security-Policy'] = \
"default-src 'none'; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self'; frame-src 'none'; font-src 'self'; connect-src 'self'" # noqa
2019-11-14 03:06:04 +00:00
return resp