crowetic/qortal
1
0
Fork 0
forked from Qortal/qortal
Code Pull Requests Activity

Disallow local (loopback address) requests when using the gateway

Browse Source 
This removes the possibility of some locally running javascript in a website or app requesting unvetted data via the local gateway.
This commit is contained in:
CalDescent 2021-11-19 13:20:53 +00:00
parent b7a0a7eea4
commit ce56cd2b16
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/main/java/org/qortal/api/Security.java
View File

@ -50,6 +50,17 @@ public abstract class Security {
} }
} }
public static void disallowLoopbackRequests(HttpServletRequest request) {
try {
InetAddress remoteAddr = InetAddress.getByName(request.getRemoteAddr());
if (remoteAddr.isLoopbackAddress()) {
throw ApiExceptionFactory.INSTANCE.createCustomException(request, ApiError.UNAUTHORIZED, "Local requests not allowed");
}
} catch (UnknownHostException e) {
throw ApiExceptionFactory.INSTANCE.createException(request, ApiError.UNAUTHORIZED);
}
}
public static ApiKey getApiKey(HttpServletRequest request) { public static ApiKey getApiKey(HttpServletRequest request) {
ApiKey apiKey = ApiService.getInstance().getApiKey(); ApiKey apiKey = ApiService.getInstance().getApiKey();
if (apiKey == null) { if (apiKey == null) {

4
src/main/java/org/qortal/api/gateway/resource/GatewayResource.java
View File

@ -27,6 +27,8 @@ public class GatewayResource {
@SecurityRequirement(name = "apiKey") @SecurityRequirement(name = "apiKey")
public HttpServletResponse getPathByName(@PathParam("name") String name, public HttpServletResponse getPathByName(@PathParam("name") String name,
@PathParam("path") String inPath) { @PathParam("path") String inPath) {
// Block requests from localhost, to prevent websites/apps from running javascript that fetches unvetted data
Security.disallowLoopbackRequests(request);
return this.get(name, ResourceIdType.NAME, Service.WEBSITE, inPath, null, "", true, true); return this.get(name, ResourceIdType.NAME, Service.WEBSITE, inPath, null, "", true, true);
} }
@ -34,6 +36,8 @@ public class GatewayResource {
@Path("{name}") @Path("{name}")
@SecurityRequirement(name = "apiKey") @SecurityRequirement(name = "apiKey")
public HttpServletResponse getIndexByName(@PathParam("name") String name) { public HttpServletResponse getIndexByName(@PathParam("name") String name) {
// Block requests from localhost, to prevent websites/apps from running javascript that fetches unvetted data
Security.disallowLoopbackRequests(request);
return this.get(name, ResourceIdType.NAME, Service.WEBSITE, "/", null, "", true, true); return this.get(name, ResourceIdType.NAME, Service.WEBSITE, "/", null, "", true, true);
} }