Mercurial > p > roundup > code
diff roundup/cgi/client.py @ 8062:28aa76443f58
fix(security): fix CVE-2024-39124, CVE-2024-39124, and CVE-2024-39125
Directions for fixing:
* `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are
vulnerable to an XSS attack. <CVE-2024-39124>` Requires fixing
tracker homes.
* `CVE-2024-39125`_ - :ref:`if Referer header is set to a script
tag, it will be executed. <CVE-2024-39125>` Fixed in release 2.4.0,
directions available for fixing in prior versions.
* `CVE-2024-39126`_ - :ref:`PDF, XML and SVG files downloaded from
an issue can contain embedded JavaScript which is
executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions
available for fixing in prior versions.
prior to 2.4.0 release this weekend that fixes the last two CVE's.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 09 Jul 2024 09:07:09 -0400 |
| parents | e1cff9745fb4 |
| children | 0e01299414a8 |
line wrap: on
line diff
--- a/roundup/cgi/client.py Mon Jul 08 13:04:05 2024 -0400 +++ b/roundup/cgi/client.py Tue Jul 09 09:07:09 2024 -0400 @@ -835,7 +835,7 @@ except (UsageError, Unauthorised) as msg: csrf_ok = False self.form_wins = True - self._error_message = msg.args + self.add_error_message(' '.join(msg.args)) # If csrf checks pass. Run actions etc. # handle_action() may handle a form submit action. @@ -873,7 +873,13 @@ # exception handlers. self.determine_language() self.db.i18n = self.translator + # prevent application/octet-stream mime type in header + # from being changed to some other type by the browser + # when mime sniffing. self.setHeader("X-Content-Type-Options", "nosniff") + # prevent script execution in downloaded SVG, XML files + # (or HTML files if enabled). + self.setHeader("Content-Security-Policy", "script-src 'none'") self.serve_file(designator) except SendStaticFile as file: self.serve_static_file(str(file))