Mirrors/sftpgo
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2025-12-06 22:30:56 +03:00
Code Issues Packages Projects Releases Wiki Activity

httpd: validate reference also for CSRF token in headers

Browse Source 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
This commit is contained in:
Nicola Murino
2024-09-14 21:45:25 +02:00
parent 14cabda5c2
commit 6896d2bfb1
4 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
internal/httpd/httpd_test.go
View File

@@ -20705,6 +20705,17 @@ func TestWebAdminBasicMock(t *testing.T) {
checkResponseCode(t, http.StatusForbidden, rr)
assert.Contains(t, rr.Body.String(), "Invalid token")
req, err = http.NewRequest(http.MethodPost, webAdminTOTPSavePath, bytes.NewBuffer(asJSON))
assert.NoError(t, err)
setJWTCookieForReq(req, altToken)
setCSRFHeaderForReq(req, csrfToken) // invalid CSRF token
req.RemoteAddr = defaultRemoteAddr
rr = executeRequest(req)
checkResponseCode(t, http.StatusForbidden, rr)
assert.Contains(t, rr.Body.String(), "the token is not valid")
csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminPath, altToken)
assert.NoError(t, err)
req, err = http.NewRequest(http.MethodPost, webAdminTOTPSavePath, bytes.NewBuffer(asJSON))
assert.NoError(t, err)
setJWTCookieForReq(req, altToken)
@@ -20781,7 +20792,7 @@ func TestWebAdminBasicMock(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusSeeOther, rr)
form.Set(csrfFormToken, "invalid csrf")
form.Set(csrfFormToken, csrfToken) // associated to altToken
req, _ = http.NewRequest(http.MethodPost, path.Join(webAdminPath, altAdminUsername), bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = defaultRemoteAddr
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
@@ -20790,6 +20801,8 @@ func TestWebAdminBasicMock(t *testing.T) {
checkResponseCode(t, http.StatusForbidden, rr)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminPath, token)
assert.NoError(t, err)
form.Set(csrfFormToken, csrfToken)
form.Set("email", "not-an-email")
req, _ = http.NewRequest(http.MethodPost, path.Join(webAdminPath, altAdminUsername), bytes.NewBuffer([]byte(form.Encode())))