mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-28 17:42:50 +09:00
Jeremy Daer
262ac6be06
Web push delivery POSTed to the endpoint URL a user supplied when registering a subscription, with no scheme, host, or private-network check -- unlike the OpenGraph unfurl path, which already routes through the shared SSRF address policy (surfguard). Any authenticated user could register a subscription whose endpoint pointed at an internal address and have the server fetch it on every chat message: blind SSRF for internal recon and reachability probing, plus a thread-pool DoS on the delivery pool. Validate the endpoint when the subscription is saved: it must be HTTPS, its host must belong to a known browser push service (allowlist), and it must resolve to a public IP. On every delivery, re-resolve the host and pin the connection to that public IP so a later DNS rebind can't redirect the request to an internal address. If no public IP resolves at delivery time -- a rebind, or a subscription that predates this validation -- delivery is skipped rather than falling back to re-resolving the raw host. Adds model, controller, and delivery-pinning tests, plus a DNS stub helper for deterministic resolution in tests.
31 lines
809 B
Ruby
31 lines
809 B
Ruby
class Users::PushSubscriptionsController < ApplicationController
|
|
before_action :set_push_subscriptions
|
|
|
|
def index
|
|
end
|
|
|
|
def create
|
|
if subscription = @push_subscriptions.find_by(push_subscription_params)
|
|
subscription.touch
|
|
head :ok
|
|
else
|
|
subscription = @push_subscriptions.create push_subscription_params.merge(user_agent: request.user_agent)
|
|
head subscription.persisted? ? :ok : :unprocessable_entity
|
|
end
|
|
end
|
|
|
|
def destroy
|
|
@push_subscriptions.destroy_by(id: params[:id])
|
|
redirect_to user_push_subscriptions_url
|
|
end
|
|
|
|
private
|
|
def set_push_subscriptions
|
|
@push_subscriptions = Current.user.push_subscriptions
|
|
end
|
|
|
|
def push_subscription_params
|
|
params.require(:push_subscription).permit(:endpoint, :p256dh_key, :auth_key)
|
|
end
|
|
end
|