diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2015-08-13 07:36:42 +0200 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2015-08-14 01:31:32 +0200 |
| commit | 8313a3fcb3b24bf9e36f48581f64336623ae1ead (patch) | |
| tree | 5f5f665dca0cd395a6706389c5e2e1f11b95380d /lib/base.php | |
| parent | 1f96fb3352ad43155586d6deae95bf889768ba05 (diff) | |
| download | nextcloud-server-8313a3fcb3b24bf9e36f48581f64336623ae1ead.tar.gz nextcloud-server-8313a3fcb3b24bf9e36f48581f64336623ae1ead.zip | |
Add mitigation against BREACH
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:
1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data
Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.
To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
Diffstat (limited to 'lib/base.php')
| -rw-r--r-- | lib/base.php | 13 |
1 files changed, 1 insertions, 12 deletions
diff --git a/lib/base.php b/lib/base.php index c0f3e50142e..07a1e8dfee3 100644 --- a/lib/base.php +++ b/lib/base.php @@ -134,18 +134,7 @@ class OC { OC_Config::$object = new \OC\Config(self::$configDir); OC::$SUBURI = str_replace("\\", "/", substr(realpath($_SERVER["SCRIPT_FILENAME"]), strlen(OC::$SERVERROOT))); - /** - * FIXME: The following line is required because of a cyclic dependency - * on IRequest. - */ - $params = [ - 'server' => [ - 'SCRIPT_NAME' => $_SERVER['SCRIPT_NAME'], - 'SCRIPT_FILENAME' => $_SERVER['SCRIPT_FILENAME'], - ], - ]; - $fakeRequest = new \OC\AppFramework\Http\Request($params, null, new \OC\AllConfig(new \OC\SystemConfig())); - $scriptName = $fakeRequest->getScriptName(); + $scriptName = $_SERVER['SCRIPT_NAME']; if (substr($scriptName, -1) == '/') { $scriptName .= 'index.php'; //make sure suburi follows the same rules as scriptName |