Repository navigation
Security: bind a stored credential to the request it was saved for - #34
Merged
Merged
Conversation
Refilling a withheld secret matched the incoming item by id alone, so a saved config could keep an item's id and its secret marker, point the request at another host, and have the server fill the real credential back in. The next poll then delivered it there, with nothing on screen to show for it. A config file is something people import from elsewhere, which makes the file the attack. The scope check that already guards the two endpoints for testing a badge or a widget now guards the save path as well: a secret is restored only when everything about that request other than the secret is unchanged. The two blocks on an app are judged separately, so moving the activity badge does not drop the credential the status badge uses. Anything withheld is named in the response and reported in the admin UI, so a save that moved a request does not look like it kept working. Restoring an export is unaffected: it changes nothing but the values.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
secret-scopecheck toPOST /api/config. A withheld secret is restored only when everything about that request other than the secret is unchanged, which is the rule the badge-proxy and widget-test endpoints already enforce.docs/security.md, which previously said secrets are preserved on save without qualification.Testing
All green: 1098 backend, 618 frontend, 94.8% line coverage, lint, format, both typechecks,
paths:checkand cache-busting. Added 6 tests covering both secret systems, the legitimate restore, and an item that never held a secret.Verified against a container before and after. Before: a config keeping an item's id and its secret marker while changing the URL caused the server's next poll to send
Authorization: Bearer <stored token>to a listener on the test network, for both a badge header and a widget config key. After: the value is not restored, the response is{"ok":true,"withheld":[{"id":"b1","label":"Badge App"}]}, the poll leaves with an empty header, and exporting then re-importing still keeps the token.Checklist