search

mei23 / misskey

めいすきー
GNU Affero General Public License v3.0
68 stars 12 forks source link

validate signed headers #4749

Closed mei23 closed 9 months ago

mei23 commented 9 months ago

Summary

Resolve #4748

AP inboxでdigestをbodyとを検証していないのを修正。 host, digestヘッダーが署名検証対象でないAP Postリクエストは弾くように。

https://github.com/misskey-dev/misskey/commit/65c5626b65ee00d2663ec3604140a18427b65cdc

Co-authored-by: perillamint <perillamint@silicon.moe>
Co-authored-by: yunochi <yuno@yunochi.com>
mei23 commented 9 months ago

https://github.com/mei23/misskey/pull/4750 も入れるとベター

mei23 commented 9 months ago

https://github.com/mei23/misskey/commit/f7c82eb3b9c947e681817f3ec92498c65b5bd864 も入れたほうがシンプル＆微修正

mei23 commented 9 months ago

https://github.com/mei23/misskey/commit/68a62388e484759b465a4aeeec804925d59c30bf https://github.com/mei23/misskey/commit/91f5007a4787970e7df914e7aa987b64a0c074ab https://github.com/mei23/misskey/commit/65add66b824475ccd656720bc1e3927b394e7a97 も

mei23 commented 9 months ago

リクエストホストも検証 https://github.com/mei23/misskey/commit/1be3c99ea721de4d6e095327a0fb085f0acf49e5