Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nautilus: mgr/dashboard: fix improper URL checking #32744

Closed
wants to merge 1 commit into from
Closed

nautilus: mgr/dashboard: fix improper URL checking #32744

wants to merge 1 commit into from

Conversation

epuertat
Copy link
Member

@epuertat epuertat commented Jan 21, 2020 •
edited

backport tracker: https://tracker.ceph.com/issues/43725

backport of #32652
parent tracker: https://tracker.ceph.com/issues/43607

This change disables up-level references beyond the HTTP base directory.
[CVE-2020-1699]

Fixes: https://tracker.ceph.com/issues/43607
Signed-off-by: Ernesto Puerta epuertat@redhat.com

(cherry picked from commit 0443e40)

Conflicts:

  • src/pybind/mgr/dashboard/tests/test_home.py (refactored tests)

Checklist

  • References tracker ticket
  • Updates documentation if necessary
  • Includes tests for new functionality or reproducer for bug
Show available Jenkins commands
  • jenkins retest this please
  • jenkins test crimson perf
  • jenkins test signed
  • jenkins test make check
  • jenkins test make check arm64
  • jenkins test submodules
  • jenkins test dashboard
  • jenkins test dashboard backend
  • jenkins test docs
  • jenkins render docs
  • jenkins test ceph-volume all
  • jenkins test ceph-volume tox

@epuertat
mgr/dashboard: fix improper URL checking
0d20243 
This change disables up-level references beyond the HTTP base directory.
[CVE-2020-1699]

Fixes: https://tracker.ceph.com/issues/43607
Signed-off-by: Ernesto Puerta <epuertat@redhat.com>

(cherry picked from commit 0443e40)

Conflicts:
  - src/pybind/mgr/dashboard/tests/test_home.py (refactored tests)
@epuertat epuertat added this to the nautilus milestone Jan 21, 2020
@epuertat epuertat self-assigned this Jan 21, 2020
@epuertat epuertat added this to In progress in Dashboard via automation Jan 21, 2020
@smithfarm smithfarm requested review from a team and removed request for smithfarm January 21, 2020 10:39
Dashboard automation moved this from In progress to Reviewer approved Jan 21, 2020
@epuertat
Copy link
Member Author

jenkins test dashboard

@epuertat
Copy link
Member Author

jenkins test make check

@epuertat
Copy link
Member Author

jenkins test dashboard backend

@alfonsomthd
Copy link
Contributor

jenkins test make check

@epuertat
Copy link
Member Author

Both make checkand dashboard backend tests seem unrelated to this change (it failed on Bionic due to Python pip issue: ImportError: cannot import name SourceDistribution).

@epuertat
Copy link
Member Author

jenkins test dashboard backend

@yuriw yuriw added the needs-qa label Jan 21, 2020
@callithea
Copy link
Member

jenkins test dashboard backend

@callithea
Copy link
Member

jenkins test dashboard backend

@callithea
Copy link
Member

Re-started the pkg build (after a rebase): https://shaman.ceph.com/builds/ceph/wip-laura-testing-dashboard-nautilus-31792-32744/

LenzGr
LenzGr approved these changes Jan 24, 2020
View reviewed changes
Copy link
Contributor

@LenzGr LenzGr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@epuertat
Copy link
Member Author

Launched QA from @callithea's packages.

@smithfarm smithfarm added the nautilus-batch-1 nautilus point releases label Jan 24, 2020
@epuertat
Copy link
Member Author

QA passed

@epuertat epuertat removed the needs-qa label Jan 24, 2020
@callithea callithea removed the nautilus-batch-1 nautilus point releases label Jan 27, 2020
@callithea
Copy link
Member

callithea commented Feb 4, 2020 •
edited

@epuertat epuertat changed the base branch from nautilus to nautilus-saved February 5, 2020 12:00
@epuertat epuertat changed the base branch from nautilus-saved to nautilus February 5, 2020 12:01
@theanalyst
Copy link
Member

already a part of 14.2.7, the branch history is messed up when viewing in gh, but this is the commit 8392c2c

@theanalyst theanalyst closed this Feb 5, 2020
Dashboard automation moved this from Reviewer approved to Done Feb 5, 2020
@epuertat epuertat deleted the fix-43725-nautilus branch February 5, 2020 12:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tchaikov tchaikov tchaikov approved these changes

@LenzGr LenzGr LenzGr approved these changes

@alfonsomthd alfonsomthd alfonsomthd approved these changes

@callithea callithea callithea approved these changes

@rjfd rjfd Awaiting requested review from rjfd

Assignees

@epuertat epuertat

Labels
bug-fix dashboard needs-qa needs-rebase wip-laura-testing
Projects
Ceph-Dashboard
Archived in project
Dashboard
  
Done
Milestone
nautilus
8 participants
@epuertat @alfonsomthd @callithea @theanalyst @tchaikov @LenzGr @yuriw @smithfarm