[Bug 32713] New: x-koha-embed appears to no longer properly validate
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 Bug ID: 32713 Summary: x-koha-embed appears to no longer properly validate Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: martin.renvoize@ptfs-europe.com CC: tomascohen@gmail.com We migrated x-koha-embed into properly specified header parameters in bug 30536 however it appears that the upstream validation of those headers has since broken and we're now allowing open embed calls through from the API. At best this can lead to server errors leaking, at worst it exposed methods that should be private to the API. We need to write some tests to catch this and possibly re-instate the in-koha validation whilst the OpenAPI is updated. See 8e1265c45ddfc53d4bcbfc51e25b297e3592daf4 for some further details. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart+koha@gmail. | |com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=30536 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 --- Comment #1 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- There are tests to catch this and they are passing still. I can't remember how we were replicating this.. do you happen to remember Jonathan? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 --- Comment #2 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Did you try to request with an embed if there is no embed defined in the specs? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Group|Koha security | Component|Koha |REST API Product|Koha security |Koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #147820|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #147821|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 --- Comment #12 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 148289 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=148289&action=edit Bug 32713: Unit tests This patch adds unit tests to prove we return a 400 and an appropriate error message when calling an endpoint that is not defined to support x-koha-embed whilst passing an x-koha-embed header. Test plan: 1) Run test prior to applying second patch and confirm it fails 2) Run test after applying second patch and confirm it passes Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 --- Comment #13 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 148290 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=148290&action=edit Bug 32713: Throw exception on unexpected x-koha-embed header This patch adds an exception to stash_embed that is thrown when we find an x-koha-embed header that we're not expecting. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |23.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 --- Comment #14 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Pushed to master for 23.05. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |additional_work_needed --- Comment #15 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- t/db_dependent/Koha/REST/Plugin/Objects.t is failing -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 --- Comment #16 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 148386 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=148386&action=edit Bug 32713: (QA follow-up) Tests now require more complex structures Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|additional_work_needed | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 --- Comment #17 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Follow-up pushed to master. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|23.05.00 |23.05.00,22.11.04 released in| | Status|Pushed to master |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 --- Comment #18 from Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> --- Nice work everyone! Pushed to stable for 22.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32713 --- Comment #19 from Lucas Gass <lucas@bywatersolutions.com> --- Doesn't apply clean to 22.05.x, no backport. If needed please rebase. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org