[
https://issues.apache.org/jira/browse/JCR-4009?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15451999#comment-15451999
]
Julian Reschke edited comment on JCR-4009 at 8/31/16 11:41 AM:
---------------------------------------------------------------
Proposed patch (applies to 2.12, not trunk)
CSRFUtil:
1. properly parse content types (handle params, also multiple field instances)
2. handle missing content type
3. handle partial-URI in referer
4. DEBUG logging
WebDAV servlet:
5. disable bogus POST support
Davex:
6. include Referer header field in POST requests
was (Author: reschke):
Proposed patch.
CSRFUtil:
1. properly parse content types (handle params, also multiple field instances)
2. handle missing content type
3. handle partial-URI in referer
4. DEBUG logging
WebDAV servlet:
5. disable bogus POST support
Davex:
6. include Referer header field in POST requests
> CSRF in Jackrabbit-Webdav
> -------------------------
>
> Key: JCR-4009
> URL: https://issues.apache.org/jira/browse/JCR-4009
> Project: Jackrabbit Content Repository
> Issue Type: Bug
> Components: jackrabbit-webdav
> Affects Versions: 2.13.2
> Reporter: Julian Reschke
> Assignee: Julian Reschke
> Priority: Blocker
> Labels: csrf, security, webdav
> Attachments: JCR-4009.diff
>
>
> The changes for JCR-4002 have disabled CRFS checking for POST, and thus leave
> the remoting servlet open for attacks. This HTML form below:
> {noformat}
> <form action="http://localhost:8080/server/default/jcr:root/"; method="post">
> <input type="text" id="name" name="user_name" />
> <button type="submit">Send your message</button>
> </form>
> {noformat}
> will successfully cross-origin-POST to jackrabbit-standalone.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
