redirects in tahoe should not point to other origins #1861

New Issue

tahoe-lafs · 2012-11-15T11:18:57Z

ChosenOne commented

2012-11-15 11:18:57 +00:00

From what I see in unlinked.py (https://tahoe-lafs.org/trac/tahoe-lafs/browser/trunk/src/allmydata/web/unlinked.py), most redirects could be filtered to only start with the protocol, domain and port of the web UI. I suppose this is non-trivial, but might be extracted from the HTTP request's Host header

The current redirection does not pose a severe risk, but it might at least prevent social engineering attacks in which a URL that starts with the tahoe's gw address wounds up on a completely different web page.

From what I see in unlinked.py (<https://tahoe-lafs.org/trac/tahoe-lafs/browser/trunk/src/allmydata/web/unlinked.py>), most redirects could be filtered to only start with the protocol, domain and port of the web UI. I suppose this is non-trivial, but might be extracted from the HTTP request's Host header The current redirection does not pose a severe risk, but it might at least prevent social engineering attacks in which a URL that starts with the tahoe's gw address wounds up on a completely different web page.

tahoe-lafs added the

labels 2012-11-15 11:18:57 +00:00

tahoe-lafs added this to the undecided milestone 2012-11-15 11:18:57 +00:00

tahoe-lafs added

code-frontend-web

and removed

unknown

labels 2012-11-16 06:25:38 +00:00

daira commented

2013-09-14 22:39:00 +00:00

The redirects are intentionally relative (most of them; see #1928) in order to allow reverse proxies to work.

zooko commented

2013-09-14 23:00:38 +00:00

Replying to daira:

The redirects are intentionally relative (most of them; see #1928) in order to allow reverse proxies to work.

So, I don't understand what ChosenOne's original issue was about. ChosenOne, daira: shall we close this ticket now?

Replying to [daira](/tahoe-lafs/trac-2024-07-25/issues/1861#issuecomment-90239): > The redirects are intentionally relative (most of them; see #1928) in order to allow reverse proxies to work. So, I don't understand what ChosenOne's original issue was about. ChosenOne, daira: shall we close this ticket now?

daira commented

2013-09-15 02:56:00 +00:00

If I understand correctly, the concern is with a kind of bounce attack. However bounce URLs are commonplace on the web, so I'm also not sure how much of a real attack this is.

zooko added the

wontfix

label 2013-09-15 05:40:21 +00:00

zooko closed this issue

2013-09-15 05:40:21 +00:00

Sign in to join this conversation.