mirror of
https://github.com/coder/coder.git
synced 2026-09-01 14:53:15 +08:00
Bobby Ho
0207a9824f
The `/api/v2/csp/reports` endpoint is unauthenticated and CSRF-exempt, since it's the browser's `report-uri` target, and decoded request bodies with no size limit. This let an attacker post arbitrarily large JSON bodies to force unbounded heap allocation and OOM the server (Cure53 CDM-02-007). Wraps the request body in `http.MaxBytesReader` before decoding and returns 413 when the limit is exceeded, matching the existing convention used by `files.go`, `aitasks.go`, and `exp_chats.go`. Fixes: https://github.com/coder/security-disclosures/issues/171
66 lines
1.9 KiB
Go
66 lines
1.9 KiB
Go
package coderd
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
|
|
"cdr.dev/slog/v3"
|
|
"github.com/coder/coder/v2/coderd/httpapi"
|
|
"github.com/coder/coder/v2/codersdk"
|
|
)
|
|
|
|
// cspReportMaxBytes bounds the size of a single CSP violation report. This
|
|
// endpoint is unauthenticated and CSRF-exempt (it's the browser's
|
|
// `report-uri` target), so it must not allow unbounded body sizes to reach
|
|
// json.Decode. Real CSP reports are small JSON objects; 64KB is generous.
|
|
const cspReportMaxBytes = 64 * 1024
|
|
|
|
type cspViolation struct {
|
|
Report map[string]interface{} `json:"csp-report"`
|
|
}
|
|
|
|
// logReportCSPViolations will log all reported csp violations.
|
|
//
|
|
// @Summary Report CSP violations
|
|
// @ID report-csp-violations
|
|
// @Security CoderSessionToken
|
|
// @Accept json
|
|
// @Tags General
|
|
// @Param request body cspViolation true "Violation report"
|
|
// @Success 200
|
|
// @Failure 413 {object} codersdk.Response
|
|
// @Router /api/v2/csp/reports [post]
|
|
func (api *API) logReportCSPViolations(rw http.ResponseWriter, r *http.Request) {
|
|
ctx := r.Context()
|
|
var v cspViolation
|
|
|
|
r.Body = http.MaxBytesReader(rw, r.Body, cspReportMaxBytes)
|
|
dec := json.NewDecoder(r.Body)
|
|
err := dec.Decode(&v)
|
|
if err != nil {
|
|
if _, ok := errors.AsType[*http.MaxBytesError](err); ok {
|
|
httpapi.Write(ctx, rw, http.StatusRequestEntityTooLarge, codersdk.Response{
|
|
Message: "Request body too large.",
|
|
Detail: fmt.Sprintf("Maximum CSP report size is %d bytes.", cspReportMaxBytes),
|
|
})
|
|
return
|
|
}
|
|
api.Logger.Warn(ctx, "CSP violation reported", slog.Error(err))
|
|
httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
|
|
Message: "Failed to read body, invalid json.",
|
|
Detail: err.Error(),
|
|
})
|
|
return
|
|
}
|
|
|
|
fields := make([]slog.Field, 0, len(v.Report))
|
|
for k, v := range v.Report {
|
|
fields = append(fields, slog.F(k, v))
|
|
}
|
|
api.Logger.Debug(ctx, "CSP violation reported", fields...)
|
|
|
|
httpapi.Write(ctx, rw, http.StatusOK, "ok")
|
|
}
|