From: Ernesto Puerta Date: Thu, 13 May 2021 15:43:56 +0000 (+0200) Subject: mgr/dashboard: fix cookie injection issue X-Git-Tag: v14.2.21~1 X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=adda853e64bdba1288d46bc7d462d23d8f2f10ca;p=ceph.git mgr/dashboard: fix cookie injection issue Fixes: CVE-2021-3509 Signed-off-by: Ernesto Puerta (cherry picked from commit b39922818bc57cde1b016e9ad41908b18063b93b) Conflicts: src/pybind/mgr/dashboard/controllers/docs.py - Remove allow_empty_body and _with_token method --- diff --git a/src/pybind/mgr/dashboard/controllers/docs.py b/src/pybind/mgr/dashboard/controllers/docs.py index f94d81f6dc26..70bea7c45cbc 100644 --- a/src/pybind/mgr/dashboard/controllers/docs.py +++ b/src/pybind/mgr/dashboard/controllers/docs.py @@ -3,8 +3,7 @@ from __future__ import absolute_import import cherrypy -from . import Controller, BaseController, Endpoint, ENDPOINT_MAP, \ - allow_empty_body +from . import Controller, BaseController, Endpoint, ENDPOINT_MAP from .. import logger, mgr from ..tools import str_to_bool @@ -366,31 +365,13 @@ class Docs(BaseController): def api_all_json(self): return self._gen_spec(True, "/api") - def _swagger_ui_page(self, all_endpoints=False, token=None): + def _swagger_ui_page(self, all_endpoints=False): base = cherrypy.request.base if all_endpoints: spec_url = "{}/docs/api-all.json".format(base) else: spec_url = "{}/docs/api.json".format(base) - auth_header = cherrypy.request.headers.get('authorization') - auth_cookie = cherrypy.request.cookie['token'] - jwt_token = "" - if auth_cookie is not None: - jwt_token = auth_cookie.value - elif auth_header is not None: - scheme, params = auth_header.split(' ', 1) - if scheme.lower() == 'bearer': - jwt_token = params - else: - if token is not None: - jwt_token = token - - api_key_callback = """, onComplete: () => {{ - ui.preauthorizeApiKey('jwt', '{}'); - }} - """.format(jwt_token) - page = """ @@ -431,23 +412,16 @@ class Docs(BaseController): SwaggerUIBundle.presets.apis ], layout: "BaseLayout" - {} }}) window.ui = ui }} - """.format(spec_url, api_key_callback) + """.format(spec_url) return page @Endpoint(json_response=False) def __call__(self, all_endpoints=False): return self._swagger_ui_page(all_endpoints) - - @Endpoint('POST', path="/", json_response=False, - query_params="{all_endpoints}") - @allow_empty_body - def _with_token(self, token, all_endpoints=False): - return self._swagger_ui_page(all_endpoints, token)