Bug 718319: (CVE-2012-0440) [SECURITY] JSON-RPC permits to bypass token checks and...

r=mkanat a=LpSolit

diff --git a/Bugzilla/WebService/Constants.pm b/Bugzilla/WebService/Constants.pm
index 8881974cd0d4e8083fe900f9c92ecb0d5baecdde..2c95f1eec28e8dc4249ffe89ceadce51a3269c07 100644 (file)
--- a/Bugzilla/WebService/Constants.pm
+++ b/Bugzilla/WebService/Constants.pm
@@ -25,6 +25,8 @@ our @EXPORT = qw(
     ERROR_UNKNOWN_FATAL
     ERROR_UNKNOWN_TRANSIENT
 
+    CONTENT_TYPE_BLACKLIST
+
     WS_DISPATCH
 );
 
@@ -167,6 +169,14 @@ use constant ERROR_UNKNOWN_TRANSIENT => 32000;
 
 use constant ERROR_GENERAL       => 999;
 
+# Blacklist content types which can lead to CSRF when using POST with JSON-RPC.
+# The default content type for JSON-RPC is application/json.
+use constant CONTENT_TYPE_BLACKLIST => qw(
+    text/plain
+    application/x-www-form-urlencoded
+    multipart/form-data
+);
+
 sub WS_DISPATCH {
     # We "require" here instead of "use" above to avoid a dependency loop.
     require Bugzilla::Hook;

diff --git a/Bugzilla/WebService/Server/JSONRPC.pm b/Bugzilla/WebService/Server/JSONRPC.pm
index 3b232aafafaa946607559342414d4eac0de2efc0..5ee341b4b11b38ffb951ed60721af6cc6afd4df6 100644 (file)
--- a/Bugzilla/WebService/Server/JSONRPC.pm
+++ b/Bugzilla/WebService/Server/JSONRPC.pm
@@ -374,6 +374,17 @@ sub _argument_type_check {
                            { method => $self->_bz_method_name });
         }
     }
+    else {
+        # CSRF is also possible when using |Content-Type: text/plain| with POST.
+        # There are some other content types which must also be banned for
+        # security reasons.
+        my $content_type = $self->cgi->content_type;
+        # The charset can be appended to the content type, so we use a regexp.
+        if (grep { $content_type =~ m{\Q$_\E}i } CONTENT_TYPE_BLACKLIST) {
+            ThrowUserError('json_rpc_illegal_content_type',
+                            { content_type => $content_type });
+        }
+    }
 
     # This is the best time to do login checks.
     $self->handle_login();

diff --git a/template/en/default/global/user-error.html.tmpl b/template/en/default/global/user-error.html.tmpl
index b4be5d86a67e215be46567cf7de04fac40e20e37..5634a7af3e9e640d7c4c911d5455922d10f4d198 100644 (file)
--- a/template/en/default/global/user-error.html.tmpl
+++ b/template/en/default/global/user-error.html.tmpl
@@ -1003,6 +1003,10 @@
     parameter. See the documentation at
     [%+ docs_urlbase FILTER html %]api/Bugzilla/WebService/Server/JSONRPC.html
 
+  [% ELSIF error == "json_rpc_illegal_content_type" %]
+    When using JSON-RPC over POST, you cannot use [% content_type FILTER html %]
+    as content type. The recommended content type is application/json.
+
   [% ELSIF error == "json_rpc_invalid_params" %]
     Could not parse the 'params' argument as valid JSON.
     Error: [% err_msg FILTER html %]