Преглед на файлове

[security] SAML login issues with csp enabled

pysaml by default gives a template which has unsafe inline code. django saml bypasses that if we use a custom template. i have defined that custom template and added a request object.

Uses the post binding form to add nonce, if the nonce is available in the request. if csp_nonce is disabled in the setting it won't be added here.

Co-authored-by: Mohammed Tabraiz <tabraiz@cloudera.com>
Tabraiz преди 10 месеца
родител
ревизия
864283cf08

+ 1 - 0
desktop/core/ext-py3/djangosaml2-0.18.0/djangosaml2/views.py

@@ -232,6 +232,7 @@ def login(request,
                     saml_request = base64.b64encode(binary_type(request_xml))
 
                 http_response = render(request, post_binding_form_template, {
+                    'request': request,
                     'target_url': location,
                     'params': {
                         'SAMLRequest': saml_request,

+ 4 - 4
desktop/core/src/desktop/templates/djangosaml2/example_post_binding_form.html → desktop/core/src/desktop/templates/djangosaml2/post_binding_form.html

@@ -1,5 +1,5 @@
-<script type="text/javascript">
-	window.onload = function(){
+<script type="text/javascript"{% if request.csp_nonce %} nonce="{{ request.csp_nonce }}"{% endif %}>
+	window.onload = function() {
 		document.SSO_Login.submit();
 	};
 </script>
@@ -9,7 +9,7 @@ Please click the button below if you're not redirected automatically within a fe
 </p>
 <form method="post" action="{{ target_url }}" name="SSO_Login">
 	{% for key, value in params.items %}
-	    <input type="hidden" name="{{ key|safe }}" value="{{ value|safe }}" />
+	    <input type="hidden" name="{{ key }}" value="{{ value }}" />
 	{% endfor %}
     <input type="submit" value="Log in" />
-</form>
+</form>