New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix unauthorized message deletion #3893

merged 2 commits into from Oct 22, 2018


None yet
2 participants
Copy link

heartsucker commented Oct 22, 2018


Ready for review

Description of Changes

Fixes #3892

Fixes a bug where a source X could delete a reply from a journalist to source Y by guessing the ID.


See original ticket for the full description of the bug and manual steps to reproduce. There is a regression test for this so make test will cover this issue.


This will not affect deployment.


If you made changes to the server application code:

  • Linting (make ci-lint) and tests (make -C securedrop test) pass in the development container

heartsucker added some commits Sep 10, 2018

check ownership of reply before deletion
This patch fixes a bug where an authenticated source A could
delete the replies send to source B if they could guess the
filename. Since we don't throttle source interactions, and
since the wordlists are public, an attack could attempt to
enumerate them.

@heartsucker heartsucker requested a review from redshiftzero as a code owner Oct 22, 2018

@heartsucker heartsucker referenced this pull request Oct 22, 2018


[0.10.0] Fix unauthorized message deletion #3894

1 of 1 task complete

emkll approved these changes Oct 22, 2018

Copy link

emkll left a comment

Great find @heartsucker, thanks for the fix! Reproduced the bug and confirm the fixes solves the issue for me. Good to merge once CI passes.

@emkll emkll merged commit 81fe080 into develop Oct 22, 2018

5 checks passed

ci/circleci: admin-tests Your tests passed on CircleCI!
ci/circleci: lint Your tests passed on CircleCI!
ci/circleci: staging-test-with-rebase Your tests passed on CircleCI!
ci/circleci: tests Your tests passed on CircleCI!
ci/circleci: updater-gui-tests Your tests passed on CircleCI!

@emkll emkll deleted the unauthorized-message-deletion branch Oct 22, 2018

@emkll emkll referenced this pull request Oct 23, 2018


Release SecureDrop 0.10.0 #3849

24 of 24 tasks complete
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment