Commit graph

55 commits

Author SHA1 Message Date
Lukas Reschke
8313a3fcb3 Add mitigation against BREACH
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:

1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data

Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.

To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
2015-08-14 01:31:32 +02:00
Morris Jobke
d56e03bb94 Merge pull request #18096 from sualko/patch-1
add data: to allowed image domains
2015-08-10 23:05:07 +02:00
sualko
5590d64612 add more unit tests for data: as allowed image domain 2015-08-10 12:42:42 +02:00
sualko
930841b67a add unit test for data: as allowed image domain 2015-08-07 12:14:30 +02:00
Bernhard Posselt
7cb0934fa2 Merge pull request #18035 from owncloud/ocs-2.0
Adding ocs/v2.php with status code mapper
2015-08-05 17:28:08 +02:00
Lukas Reschke
4efa7c09b1 Use StringUtils::equals on CSRF token and add unit tests 2015-08-04 18:34:33 +02:00
Thomas Müller
649cc2fa89 Remove duplicate and unused code 2015-08-03 21:03:11 +02:00
Thomas Müller
bd71540c8a Fixing 'Undefined index: REMOTE_ADDR' - fixes #17460 2015-07-16 16:40:57 +02:00
Lukas Reschke
62e3de1bdb Check if response could get generated
`json_encode` fails hard on PHP >= 5.5 if a non UTF-8 value is specified by returning false. Older PHP versions just nullify the value which makes it at least somewhat usable.

This leads to very confusing errors which are very hard to debug since developers are usually not aware of this. In this case I'd consider throwing a fatal exception – since it arguably is an error situation – is a fair solution since this makes developers and administrators aware of any occurence of the problem so that these bugs can get fixed.

Fixes https://github.com/owncloud/core/issues/17265
2015-07-02 11:42:51 +02:00
Lukas Reschke
4d23e06097 Fix undefined offset
There are cases where no trusted host is specified such as when installing the instance, this lead to an undefined offset warning in the log right after installing. (when another domain than localhost or 127.0.0.1 was used)
2015-06-22 12:28:07 +02:00
Lukas Reschke
34f5541088 Add no-store to AppFramework 2015-06-15 18:35:41 +02:00
Joas Schilling
d3e3a84cae Move the helpful method to the TestCase class 2015-06-03 12:33:29 +02:00
Lukas Reschke
a62190a72d Add support for disallowing domains to the ContentSecurityPolicy
For enhanced security it is important that there is also a way to disallow domains, including the default ones.

With this commit every method gets added a new "disallow" function.
2015-05-20 11:44:37 +02:00
Lukas Reschke
b29940d956 Add support for 'child-src' directive
This is required when working with stuff such as PDF.js in the files_pdfviewer application. Opt-in only.

Master change only because the stable CSP policies has a failback that allows nearly anything 🙈
2015-02-28 12:27:46 +01:00
Bernhard Posselt
95239ad21e AppFramework StreamResponse
First stab at the StreamResponse, see #12988

The idea is to use an interface ICallbackResponse (I'm not 100% happy with the name yet, suggestions?) that allow the response to output things in its own way, for instance stream the file using readfile

Unittests are atm lacking, plan is to

check if a mock of ICallbackResponse will be used by calling its callback (also unhappy with this name) method
Usage is:

$response = new StreamResponse('path/to/file');

rename io to output, add additional methods and handle error and not modified cases when using StreamResponse

fix indention and uppercasing, also handle forbidden cases

fix indention

fix indention

no forbidden, figuring out if a file is really readable is too complicated to get to work across OSes and streams

remove useless import

remove useless import

fix intendation
2015-02-27 15:42:33 +01:00
Lukas Reschke
1c6eae9017 Get the real protocol behind several proxies
X-Forwarded-Proto contains a list of protocols if ownCloud is behind multiple reverse proxies.

This is a revival of https://github.com/owncloud/core/pull/11157 using the new IRequest public API.
2015-02-24 12:24:55 +01:00
Clark Tomlinson
8d09cc3b91 Merge pull request #13989 from owncloud/enhancment/security/11857
Allow AppFramework applications to specify a custom CSP header
2015-02-18 10:27:29 -05:00
Lukas Reschke
886bda5f81 Refactor OC_Request into TrustedDomainHelper and IRequest
This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed.

This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions.

Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though.

Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969
2015-02-16 22:13:00 +01:00
Lukas Reschke
a9d1a01440 Rename to allowEval 2015-02-16 12:30:21 +01:00
Lukas Reschke
b20174bdad Allow AppFramework applications to specify a custom CSP header
This change allows AppFramework applications to specify a custom CSP header for example when the default policy is too strict. Furthermore this allows us to partially migrate away from CSS and allowed eval() in our JavaScript components.

Legacy ownCloud components will still use the previous policy. Application developers can use this as following in their controllers:
```php
$response = new TemplateResponse('activity', 'list', []);
$cspHelper = new ContentSecurityPolicyHelper();
$cspHelper->addAllowedScriptDomain('www.owncloud.org');
$response->addHeader('Content-Security-Policy', $cspHelper->getPolicy());
return $response;
```

Fixes https://github.com/owncloud/core/issues/11857 which is a pre-requisite for https://github.com/owncloud/core/issues/13458 and https://github.com/owncloud/core/issues/11925
2015-02-16 11:00:41 +01:00
Vincent Petry
5296767393 Merge pull request #13921 from owncloud/ocs-af
Add a controller and reponse for ocs
2015-02-09 18:11:47 +01:00
Lukas Reschke
770fa761b8 Respect mod_unique_id and refactor OC_Request::getRequestId
When `mod_unique_id` is enabled the ID generated by it will be used for logging. This allows for correlation of the Apache logs and the ownCloud logs.

Testplan:

- [ ] When `mod_unique_id` is enabled the request ID equals the one generated by `mod_unique_id`.
- [ ] When `mod_unique_id` is not available the request ID is a 20 character long random string
- [ ] The generated Id is stable over the lifespan of one request

Changeset looks a little bit larger since I had to adjust every unit test using the HTTP\Request class for proper DI.

Fixes https://github.com/owncloud/core/issues/13366
2015-02-09 11:53:11 +01:00
Bernhard Posselt
fdc64e370c add a controller and reponse for ocs 2015-02-05 14:02:17 +01:00
Bernhard Posselt
bb0c88a577 always set url parameters when they are available in the app dispatch
prefer url parameters passed into the main method. If they are not present, use the containers urlParameters

add space
2015-01-15 15:22:52 +01:00
Morris Jobke
bf1b62a34a PHP < 5.4 is not supported anymore - see #12606 2014-12-04 11:05:45 +01:00
Morris Jobke
2c5e4b3d3f Remove last traces of travis integration 2014-12-04 10:09:13 +01:00
Lukas Reschke
048139074d Add functions to modify cookies to response class
Currently there is no AppFramework way to modify cookies, which makes it unusable for quite some use-cases or results in untestable code.

This PR adds some basic functionalities to add and invalidate cookies.

Usage:
```php
$response = new TemplateResponse(...);
$response->addCookie('foo', 'bar');
$response->invalidateCookie('foo');
$response->addCookie('bar', 'foo', new \DateTime('2015-01-01 00:00'));
```

Existing cookies can be accessed with the AppFramework using `$this->request->getCookie($name)`.
2014-11-27 14:19:00 +01:00
Joas Schilling
6202ca33ba Make remaining files extend the test base 2014-11-19 14:53:59 +01:00
Bernhard Posselt
91a23bfa9c fix typo in content type 2014-11-05 12:04:56 +01:00
Thomas Müller
f776bcd4a0 remove unnecessary require calls - the ownCloud class loader is supposed to take care of this 2014-10-30 17:20:40 +01:00
Bernhard Posselt
0696099bad add dataresponse
fix docstrings

adjust copyright date

another copyright date update

another header update

implement third headers argument, fix indention, fix docstrings

fix docstrings
2014-10-29 09:43:47 +01:00
Morris Jobke
e717833b07 mark tests as skipped - TODO travis
* swift causes some timeouts and test failures
2014-08-05 18:35:47 +02:00
Bernhard Posselt
a152e320f6 make it possible to omit parameters and use the default parameters from the controller method 2014-05-13 10:40:49 +02:00
Bernhard Posselt
1d45239c65 adjust license headers to new mail address 2014-05-11 17:54:08 +02:00
Bernhard Posselt
cb666c18d6 rename formatter to responder, formatResponse to buildResponse 2014-05-11 17:54:08 +02:00
Bernhard Posselt
d8da79cab0 add test for not failing when adding more comments after type parameters, do not limit x-www-form-urlencoded to POST 2014-05-11 17:54:08 +02:00
Bernhard Posselt
80648da431 implement most of the basic stuff that was suggested in #8290 2014-05-11 17:54:08 +02:00
Bernhard Posselt
9a4d204b55 add cors middleware
remove methodannotationreader namespace

fix namespace for server container

fix tests

fail if with cors credentials header is set to true, implement a reusable preflighted cors method in the controller baseclass, make corsmiddleware private and register it for every request

remove uneeded  local in cors middleware registratio

dont uppercase cors to easily use it from routes

fix indention

comment fixes

explicitely set allow credentials header to false

dont depend on better controllers PR, fix that stuff later

split cors methods to be in a seperate controller for exposing apis

remove protected definitions from apicontroller since controller has it
2014-05-09 23:34:41 +02:00
Bernhard Posselt
7e447f4f42 make download and redirectresponse public 2014-04-20 16:12:46 +02:00
Morris Jobke
5a1a056c6d Merge pull request #8183 from owncloud/move-security-headers
Move security headers
2014-04-16 23:46:20 +02:00
Lukas Reschke
b04d95b116 Remove uneeded usages of nosniff 2014-04-13 12:48:16 +02:00
Bernhard Posselt
62cce982bb default to GET request when no method is set to fix unittests, also set parsed json parameters on the post attribute 2014-04-12 16:17:49 +02:00
Thomas Tanghus
8f6ea900f2 Chainable Response in AppFramework 2014-03-09 23:01:16 +01:00
Jörn Friedrich Dreyer
39f2f564a9 use assertSame and assertNotSame for etag checks 2014-02-27 09:39:34 +01:00
Scrutinizer Auto-Fixer
adaee6a5a1 Scrutinizer Auto-Fixes
This patch was automatically generated as part of the following inspection:
https://scrutinizer-ci.com/g/owncloud/core/inspections/cdfecc4e-a37e-4233-8025-f0d7252a8720

Enabled analysis tools:
 - PHP Analyzer
 - JSHint
 - PHP Copy/Paste Detector
 - PHP PDepend
2014-02-19 09:31:54 +01:00
Thomas Tanghus
ad017285e1 Fix namespace for OCP\Appframework\Http
To avoid having to use OCP\Appframework\Http\Http in the public - and stable
- API OCP\Appframework\Http is now both a class and a namespace.
2013-10-23 05:57:34 +02:00
Thomas Tanghus
d75d80ba13 OCP\AppFramework\Controller\Controller => OCP\AppFramework\Controller 2013-10-11 10:07:57 +02:00
Thomas Müller
1e5012fc1d fixing all appframework unit tests 2013-10-07 11:25:50 +02:00
Thomas Tanghus
aedc427ffd Fix fix of POST :P 2013-10-03 03:56:37 +02:00
Thomas Tanghus
965ce5719f Modified PUT behaviour
Now only non-parable PUT requests return a stream resource.
2013-10-02 22:13:40 +02:00