search

pombreda / appscale

Automatically exported from code.google.com/p/appscale
0 stars 0 forks source link

Move PbServer to port 451 #191

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
Security issue with URL Fetch. Moving to ports which are not allowed by URL
fetch.

Original issue reported on code.google.com by nlak...@gmail.com on 12 Apr 2010 at 10:09

GoogleCodeExporter commented 9 years ago 
When setting the datastore location, make the string <hostname>:<port> to 
dictate the
new port assignment. The pbserver must be spawned with the -p flag to dictate 
the
port to bind to.

Original comment by nlak...@gmail.com on 14 Apr 2010 at 8:19

GoogleCodeExporter commented 9 years ago 
I don't entirely understand the security problem here. Surely a malicious user 
could
construct protocol buffers to try to inappropriately access the database, but 
don't
they still need the (1) secret and (2) certificates needed for encryption?

Original comment by shattere...@gmail.com on 14 Apr 2010 at 10:24

GoogleCodeExporter commented 9 years ago 
There is no secret for the pbserver, only for the soap server. The protocol 
buffer
class has sendCommand, which a user could use. It has the required pem and 
secret key
needed.

Original comment by nlak...@gmail.com on 14 Apr 2010 at 11:02

GoogleCodeExporter commented 9 years ago

Original comment by nlak...@gmail.com on 28 Mar 2011 at 10:35