Sfoglia il codice sorgente

HUE-4704 [security] Fixed Arbitrary host header accepted in Hue

Prakash Ranade 9 anni fa
parent
commit
f4bc5f8

+ 1 - 1
desktop/conf.dist/hue.ini

@@ -220,7 +220,7 @@
 
   # Comma separated list of strings representing the host/domain names that the Hue server can serve.
   # e.g.: localhost,domain1,*
-  ## allowed_hosts=*
+  ## allowed_hosts="host.domain1"
 
   # Administrators
   # ----------------

+ 1 - 1
desktop/conf/pseudo-distributed.ini.tmpl

@@ -228,7 +228,7 @@
 
   # Comma separated list of strings representing the host/domain names that the Hue server can serve.
   # e.g.: localhost,domain1,*
-  ## allowed_hosts=*
+  ## allowed_hosts="host.domain1"
 
   # Administrators
   # ----------------

+ 11 - 1
desktop/core/src/desktop/conf.py

@@ -64,6 +64,16 @@ def coerce_file(path):
 def coerce_timedelta(value):
   return datetime.timedelta(seconds=int(value))
 
+def get_dn():
+  """This function returns fqdn(if possible)"""
+  val = []
+  LOG = logging.getLogger(__name__)
+  try:
+    val.append(socket.getfqdn())
+  except:
+    LOG.warning("allowed_hosts value to '*'. It is a security risk")
+    val.append('*')
+  return val
 
 def coerce_positive_integer(integer):
   integer = int(integer)
@@ -388,7 +398,7 @@ LOG_REDACTION_FILE = Config(
 
 ALLOWED_HOSTS = Config(
   key='allowed_hosts',
-  default=['*'],
+  dynamic_default=get_dn,
   type=coerce_csv,
   help=_('Comma separated list of strings representing the host/domain names that the Hue server can serve.')
 )