[
https://issues.apache.org/jira/browse/JSPWIKI-1306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135558#comment-18135558
]
Arturo Bernal commented on JSPWIKI-1306:
----------------------------------------
Thanks for the patch and the header dump. I did not run WikiBag, because it is
third-party code I have not reviewed beyond reading its source. I tested the
filter side with a small servlet of my own mapped at /sharetest that returns a
fixed text, in Tomcat 10.1 (JDK 17), with a logged-in test user and curl.
Variant tested: a new filter parameter servletWhitelist (read like the other
filter settings, so jspwiki.http.filters.csrf.servletWhitelist), a comma
separated list of exact servlet paths. A POST without token is accepted only if
all three hold: the path is in the list, the session is authenticated, and the
request has Sec-Fetch-Site: same-origin. Otherwise the normal token check
applies.
Results, POST without token:
- logged in, same-origin, /sharetest: 200, servlet reached
- logged in, cross-site: rejected (Forbidden)
- logged in, same-site: rejected
- logged in, no Sec-Fetch-Site header: rejected
- anonymous, same-origin: rejected
- logged in, same-origin, /Wiki.jsp (not listed): rejected
- logged in, same-origin, /sharetest/x: rejected
- same request with no whitelist configured: rejected
The unit tests of CsrfProtectionFilterTest also cover these cases (23 tests
pass).
What this does not show: the header values were set by me with curl. That
Chrome sends Sec-Fetch-Site: same-origin for the Web Share Target request is
only evidenced by your dump, from one browser. The rule also depends on the
browser sending Sec-Fetch-Site; older browsers do not and would need the token.
Differences to your patch: it checks the authenticated session of JSPWiki
instead of relying on the container, it needs the same-origin header, and it
matches exact paths instead of a regex.
The code is not pushed anywhere yet.
> Whitelist for CsrfProtectionFilter
> ----------------------------------
>
> Key: JSPWIKI-1306
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1306
> Project: JSPWiki
> Issue Type: New Feature
> Components: Filters
> Affects Versions: 3.0.0, 2.12.5
> Reporter: Jürgen Weber
> Priority: Minor
> Attachments: CsrfProtectionFilter.java.patch, wikibag-headers.txt
>
>
> CsrfProtectionFilter filters all post requests that do not have the correct
> X-XSRF-TOKEN.
> So, a post request for a web api in JSPWiki cannot get through, as a rest
> client cannot aquire a token.
> There should be a whitelist.
> The appended patch would open access for servlets in a whitelist.
> E.g.
> jspwiki.CsrfProtectionFilter.servletWhitelist=/aservlet
> for a servlet at url-pattern/aservlet/*
> Apply with git apply CsrfProtectionFilter.java.patch
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
