RSE-1052: fix IP disclosure when request doesnt have Host header #9110
Conversation
|
Testing the solution feasibility: By passing the host header in: |
| @@ -50,6 +55,9 @@ class JettyServletContainerCustomizer implements WebServerFactoryCustomizer<Jett | |||
| } | |||
| }) | |||
| factory.addServerCustomizers(new BanHttpMethodCustomizer()) | |||
| if(featureService.featurePresent("setServerUrlOnNohostHeader", false)) { | |||
| factory.addServerCustomizers(new RundeckHostHeaderCustomizer(serverUrl, Integer.parseInt(serverPort ?: "4440"))) | |||
There was a problem hiding this comment.
| factory.addServerCustomizers(new RundeckHostHeaderCustomizer(serverUrl, Integer.parseInt(serverPort ?: "4440"))) | |
| factory.addServerCustomizers(new RundeckHostHeaderCustomizer(serverUrl: serverUrl, serverPort : Integer.parseInt(serverPort ?: "4440"))) |
| String serverUrl | ||
| int serverPort | ||
|
|
||
| RundeckHostHeaderCustomizer(String serverUrl) { |
There was a problem hiding this comment.
you don't need the explicit constructors in groovy.
In Groovy, the default constructor is a no-argument constructor that is automatically provided by the language if no other constructors are defined. This constructor allows you to create an instance of a class without passing any arguments. Additionally, Groovy's default constructor enables you to use named parameters in a map-like syntax to set properties when creating an instance of the class.
| @@ -24,6 +25,28 @@ class BanHttpMethodCustomizer implements JettyServerCustomizer { | |||
| } | |||
| } | |||
|
|
|||
| class RundeckHostHeaderCustomizer implements JettyServerCustomizer { | |||
There was a problem hiding this comment.
IIUIC, this inner class does not logically belong to the BanHttpMethodCustomizer class.
| @@ -50,6 +55,9 @@ class JettyServletContainerCustomizer implements WebServerFactoryCustomizer<Jett | |||
| } | |||
| }) | |||
| factory.addServerCustomizers(new BanHttpMethodCustomizer()) | |||
| if(featureService.featurePresent("setServerUrlOnNohostHeader", false)) { | |||
There was a problem hiding this comment.
Is it possible that the server.address is not configured?
If so, I'm pretty sure the redirects (302s) will break.
Is this a bugfix, or an enhancement? Please describe.
When performing a request to Rundeck with no Host header, the internal IP is revealed on the response
Describe the solution you've implemented
This PR add a customizer that is enabled by the config
rundeck.feature.setServerUrlOnNohostHeader.enabledthat will force the serverUrl and serverPort in the response if there is no Host header on requestDescribe alternatives you've considered
Additional context