Mercurial > p > roundup > code
comparison test/test_cgi.py @ 5924:b40059d7036f
issue2550925 strip HTTP_PROXY environment variable
if deployed as CGI and client sends an http PROXY
header, the tainted HTTP_PROXY environment variable is created. It
can affect calls using requests package or curl. A roundup admin
would have to write detectors/extensions that use these mechanisms.
Not exploitable in default config.
See: https://httpoxy.org/
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Sun, 13 Oct 2019 17:45:06 -0400 |
| parents | 26cd8e8bbed3 |
| children | fe334430ca07 |
comparison
equal
deleted
inserted
replaced
| 5923:45c691a81f75 | 5924:b40059d7036f |
|---|---|
| 828 cl = self.setupClient({ }, 'issue', | 828 cl = self.setupClient({ }, 'issue', |
| 829 env_addon = {'HTTP_REFERER': 'http://whoami.com/path/'}) | 829 env_addon = {'HTTP_REFERER': 'http://whoami.com/path/'}) |
| 830 out = pt.render(cl, 'issue', MockNull()) | 830 out = pt.render(cl, 'issue', MockNull()) |
| 831 self.assertEqual(out, '<?xml version="1.0" encoding="UTF-8"?><feed\n xmlns="http://www.w3.org/2005/Atom"/>\n') | 831 self.assertEqual(out, '<?xml version="1.0" encoding="UTF-8"?><feed\n xmlns="http://www.w3.org/2005/Atom"/>\n') |
| 832 | 832 |
| 833 def testHttpProxyStrip(self): | |
| 834 os.environ['HTTP_PROXY'] = 'http://bad.news/here/' | |
| 835 cl = self.setupClient({ }, 'issue', | |
| 836 env_addon = {'HTTP_PROXY': 'http://bad.news/here/'}) | |
| 837 out = [] | |
| 838 def wh(s): | |
| 839 out.append(s) | |
| 840 cl.write_html = wh | |
| 841 cl.main() | |
| 842 self.assertFalse('HTTP_PROXY' in cl.env) | |
| 843 self.assertFalse('HTTP_PROXY' in os.environ) | |
| 844 | |
| 833 def testCsrfProtection(self): | 845 def testCsrfProtection(self): |
| 834 # need to set SENDMAILDEBUG to prevent | 846 # need to set SENDMAILDEBUG to prevent |
| 835 # downstream issue when email is sent on successful | 847 # downstream issue when email is sent on successful |
| 836 # issue creation. Also delete the file afterwards | 848 # issue creation. Also delete the file afterwards |
| 837 # just tomake sure that someother test looking for | 849 # just tomake sure that someother test looking for |