Commit Graph

161 Commits

Author SHA1 Message Date
Roeland Jago Douma 4eebccd81f
Fix inconsistent nameing of AppFramework 2016-04-22 16:00:00 +02:00
Lukas Reschke 331e4efacb
Move login form into controller
First step on getting the authorisation stuff cleaned up. This is only for the login form, all other stuff is still where it is.
2016-04-15 17:36:23 +02:00
Roeland Jago Douma 2a0244df27
Fix mappertest 2016-04-08 15:23:09 +02:00
Joas Schilling 2a0cda74d4 Use IQueryBuilder::PARAM_* instead of \PDO::PARAM_* 2016-02-29 09:44:40 +01:00
v1r0x ec6e8c1ab6 fix unit test 2016-02-18 12:39:19 +01:00
Joas Schilling 599eb141b4 Make sure tests don't leave a stray directory behind 2016-02-03 12:57:22 +01:00
Lukas Reschke 809ff5ac95 Add public API to give developers the possibility to adjust the global CSP defaults
Allows to inject something into the default content policy. This is for
example useful when you're injecting Javascript code into a view belonging
to another controller and cannot modify its Content-Security-Policy itself.
Note that the adjustment is only applied to applications that use AppFramework
controllers.

To use this from your `app.php` use `\OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy)`,
$policy has to be of type `\OCP\AppFramework\Http\ContentSecurityPolicy`.

To test this add something like the following into an `app.php` of any enabled app:
```
$manager = \OC::$server->getContentSecurityPolicyManager();
$policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false);
$policy->addAllowedFrameDomain('asdf');
$policy->addAllowedScriptDomain('yolo.com');

$policy->allowInlineScript(false);
$manager->addDefaultPolicy($policy);
$policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false);
$policy->addAllowedFontDomain('yolo.com');
$manager->addDefaultPolicy($policy);

$policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false);
$policy->addAllowedFrameDomain('banana.com');
$manager->addDefaultPolicy($policy);
```

If you now open the files app the policy should be:

```
Content-Security-Policy:default-src 'none';script-src yolo.com 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src yolo.com 'self';connect-src 'self';media-src 'self';frame-src asdf banana.com 'self'
```
2016-01-28 18:36:46 +01:00
Lukas Reschke a977465af5 Add new CSRF manager for unit testing purposes
This adds a new CSRF manager for unit testing purposes, it's interface is based upon https://github.com/symfony/security-csrf. Due to some of our required custom changes it is however not possible to use the Symfony component directly.
2016-01-25 20:03:40 +01:00
Roeland Jago Douma 07fd3889b1 Fix unit tests 2016-01-11 20:29:48 +01:00
Roeland Jago Douma b2df7b6b8a Fix unit test 2015-12-24 09:20:26 +01:00
Bernhard Posselt 23c754aed3 prefer scalar type hints over phpdoc annotation
use method exists lookup to be safe and not break on old hhvm versions

add test that checks if type hint is preferred over annotation
2015-12-24 09:20:26 +01:00
Scrutinizer Auto-Fixer 453e1bf66e Scrutinizer Auto-Fixes
This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com
2015-12-07 15:43:36 +00:00
Thomas Müller 602b636d3e Merge pull request #20807 from owncloud/dont-append-redirect-url-if-user-is-already-logged-in
Don't append redirect URL if user is logged-in
2015-12-03 16:53:59 +01:00
Lukas Reschke f4eb15d340 Show error template
Otherwise this leads to an endless redirection in case of a CSRF exception. Also sets user expectation right.
2015-11-30 11:25:52 +01:00
Thomas Müller 7e71d8231e Mock DIContainer to not hit the database 2015-11-30 10:55:05 +01:00
Thomas Müller 3bb6dcea64 Apply DB group annotation ... 2015-11-30 10:55:05 +01:00
Thomas Müller 9c1dbaf0ad Merge pull request #20788 from owncloud/catch-missing-route
Dont die when we're missing a route
2015-11-30 10:11:12 +01:00
Robin Appelman aa822f76e2 fix tests 2015-11-27 17:05:58 +01:00
Mitar e0e51fd79f Added tests. 2015-11-27 02:45:49 -08:00
Thomas Müller 358858c9e3 Fix undefined HTTP_USER_AGENT 2015-11-22 16:05:50 +01:00
Lukas Reschke 8133d46620 Remove dependency on ICrypto + use XOR 2015-10-21 17:33:41 +02:00
Thomas Müller 020bb33150 Merge pull request #19034 from owncloud/http-request-warning
Prevent warning decoding content
2015-10-08 21:51:47 +02:00
Lukas Reschke 80a232da6a Add \OCP\IRequest::getHttpProtocol
Only allow valid HTTP protocols.

Ref https://github.com/owncloud/core/pull/19537#discussion_r41252333 + https://github.com/owncloud/security-tracker/issues/119
2015-10-06 14:18:46 +02:00
Thomas Müller ff75652cb7 Merge pull request #19299 from owncloud/fixgetRawPathInfo
Fix get raw path info, always return a string
2015-09-30 22:17:02 +02:00
Lukas Reschke e735a9915c Add blob: scheme to default CSP policy
Fixes https://github.com/owncloud/core/issues/19438
2015-09-29 14:27:35 +02:00
Robin McCorkell ebe9bea709 Unit test for preventing warning decoding content 2015-09-23 14:16:41 +01:00
Jörn Friedrich Dreyer ca8d589f27 use assertSame, add failing case 2015-09-23 12:31:45 +02:00
Lukas Reschke 0943781ccf Rename data provider to avoid risky test warning
```
06:49:56 There was 1 risky test:
06:49:56
06:49:56 1) OC\AppFramework\Http\JSONResponseTest::testRenderProvider
06:49:56 This test did not perform any assertions
```
2015-09-09 12:52:54 +02:00
Lukas Reschke f9e90e92d4 Encode HTML tags in JSON
While not encoding the HTML tags in the JSON response is perfectly fine since we set the proper mimetype as well as disable content sniffing a lot of automated code scanner do report this as security bug. Encoding them leads to less discussions and a lot of saved time.
2015-09-03 00:44:46 +02:00
Roeland Jago Douma f12caf930e Properly return 304
The ETag set in the IF_NONE_MODIFIED header is wraped in quotes (").
However the ETag that is set in response is not (yet). Also we need to
cast the ETag to a string.

* Added unit test
2015-09-01 11:04:41 +02:00
Lukas Reschke 8313a3fcb3 Add mitigation against BREACH
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:

1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data

Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.

To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
2015-08-14 01:31:32 +02:00
Thomas Müller abd3d5c6a5 Merge pull request #17982 from owncloud/appframework-sanitize-name
Sanitize class names before registerService/query
2015-08-12 12:19:24 +02:00
Robin McCorkell cd0a2874de Merge pull request #17852 from owncloud/register-alias-factory
Add test for factories
2015-08-11 13:30:56 +01:00
Morris Jobke d56e03bb94 Merge pull request #18096 from sualko/patch-1
add data: to allowed image domains
2015-08-10 23:05:07 +02:00
sualko 5590d64612 add more unit tests for data: as allowed image domain 2015-08-10 12:42:42 +02:00
sualko 930841b67a add unit test for data: as allowed image domain 2015-08-07 12:14:30 +02:00
Bernhard Posselt 7cb0934fa2 Merge pull request #18035 from owncloud/ocs-2.0
Adding ocs/v2.php with status code mapper
2015-08-05 17:28:08 +02:00
Lukas Reschke 4efa7c09b1 Use StringUtils::equals on CSRF token and add unit tests 2015-08-04 18:34:33 +02:00
Thomas Müller 3ecf7fce79 Fix unit test within OCSController 2015-08-03 22:19:04 +02:00
Thomas Müller 649cc2fa89 Remove duplicate and unused code 2015-08-03 21:03:11 +02:00
Robin McCorkell 182bc17aeb Sanitize class names before registerService/query
Leading backslashes are removed, so a `registerService('\\OC\\Foo')`
can still be resolved with `query('OC\\Foo')`.
2015-07-30 21:02:16 +01:00
Robin McCorkell 0223221a64 Fix incorrect test naming
`tesOverrideService()` was incorrect and wasn't getting called by
PHPUnit. Also, the unit test itself was wrong, but went unnoticed
because of point 1.
2015-07-30 16:06:26 +01:00
Bernhard Posselt d8673dabe3 add test for factories
use ref for factory test

use a factory for registerAlias

Ensure we construct SimpleContainer

Use single instance of DIContainer in routing tests
2015-07-25 01:59:30 +02:00
Thomas Müller 1f8ee61006 Merge pull request #17755 from owncloud/alias-container-alive
Add registerAlias method to shortcut interface registration #17714
2015-07-24 13:11:32 +02:00
Lukas Reschke 7dda86f371 Return proper status code in case of a CORS exception
When returning a 500 statuscode external applications may interpret this as an error instead of handling this more gracefully. This will now make return a 401 thus.

Fixes https://github.com/owncloud/core/issues/17742
2015-07-20 12:54:22 +02:00
Bernhard Posselt a4e3939204 add registerAlias method to shorcut interface registration
remove unused import

add since tag

fix typo
2015-07-18 13:43:54 +02:00
Thomas Müller bd71540c8a Fixing 'Undefined index: REMOTE_ADDR' - fixes #17460 2015-07-16 16:40:57 +02:00
Lukas Reschke 62e3de1bdb Check if response could get generated
`json_encode` fails hard on PHP >= 5.5 if a non UTF-8 value is specified by returning false. Older PHP versions just nullify the value which makes it at least somewhat usable.

This leads to very confusing errors which are very hard to debug since developers are usually not aware of this. In this case I'd consider throwing a fatal exception – since it arguably is an error situation – is a fair solution since this makes developers and administrators aware of any occurence of the problem so that these bugs can get fixed.

Fixes https://github.com/owncloud/core/issues/17265
2015-07-02 11:42:51 +02:00
Morris Jobke da45fad3eb Merge pull request #17078 from owncloud/fix-initial-server-host
Fix undefined offset
2015-07-01 08:55:12 +02:00
Lukas Reschke 4d23e06097 Fix undefined offset
There are cases where no trusted host is specified such as when installing the instance, this lead to an undefined offset warning in the log right after installing. (when another domain than localhost or 127.0.0.1 was used)
2015-06-22 12:28:07 +02:00