mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-05-08 16:05:05 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 17

enforce sanitizing padID for websocket connections

Browse source 
- only enforce for newly created pads, to combat case-sensitive pad name hijacking
This commit is contained in:
Daniel Habenicht 2022-05-30 12:15:57 +02:00 • committed by SamTV12345
parent bf810c7114
commit 3e0e649279
2 changed files with 16 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/node/handler/PadMessageHandler.js
View file

@ -236,6 +236,11 @@ exports.handleMessage = async (socket, message) => {
padID: message.padId,
token: message.token,
};
// Pad does not exist, so we need to sanitize the id
if (!(await padManager.doesPadExist(thisSession.auth.padID))) {
thisSession.auth.padID = await padManager.sanitizePadId(thisSession.auth.padID);
}
const padIds = await readOnlyManager.getIds(thisSession.auth.padID);
thisSession.padId = padIds.padId;
thisSession.readOnlyPadId = padIds.readOnlyPadId;

22
src/tests/backend/specs/lowerCasePadIds.js
View file

@ -8,8 +8,8 @@ const settings = require('../../../node/utils/Settings');
describe(__filename, function () {
let agent;
const cleanUpPads = async () => {
const padIds = ['UPPERCASEpad', 'uppercasepad', 'ALREADYexistingPad', 'alreadyexistingpad'];
await Promise.all(padIds.map(async (padId) => {
const {padIDs} = await padManager.listAllPads();
await Promise.all(padIDs.map(async (padId) => {
if (await padManager.doesPadExist(padId)) {
const pad = await padManager.getPad(padId);
await pad.remove();
@ -77,14 +77,14 @@ describe(__filename, function () {
assert.equal(newPadHandshake.data.collab_client_vars.initialAttributedText.text, 'newpad\n');
});
// it('disallow socket connection', async function () {
// debugger;
// const res = await agent.get('/p/pad').expect(200);
// const socket = await common.connect(res);
// const deny = await common.handshake(socket, 'Pad');
// assert.equal(deny.accessStatus, 'deny');
// const ok = await common.handshake(socket, 'pad');
// assert.equal(ok.type, 'CLIENT_VARS');
// });
it('disallow creation of different case pad-name via socket connection', async function () {
await padManager.getPad('maliciousattempt', 'attempt');
const newPad = await agent.get('/p/maliciousattempt').expect(200);
const newPadSocket = await common.connect(newPad);
const newPadHandshake = await common.handshake(newPadSocket, 'MaliciousAttempt');
assert.equal(newPadHandshake.data.collab_client_vars.initialAttributedText.text, 'attempt\n');
});
});
});