{"thread":{"id":"27734","subject":"[PATCHv2 0/2] gitweb: Make $prevent_xss protection for 'blob_plain' more usable","startedAt":"2011-06-30T09:39:19Z","lastAt":"2011-06-30T18:22:03Z","messageCount":4,"participants":["Jakub Narebski","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"170704","messageId":"1309426761-819-1-git-send-email-jnareb@gmail.com","threadId":"27734","inReplyTo":null,"subject":"[PATCHv2 0/2] gitweb: Make $prevent_xss protection for 'blob_plain' more usable","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2011-06-30T09:39:19Z","receivedAt":"2011-06-30T09:39:19Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"This series is improvement and extending of patch with the same name,\ncontaining only the first patch in the series, sent to git mailing\nlist on 10.06.2011, and present in 'pu' as fb76adb (jn/mime-type-with-params).\n\nThis series is to replace it.\n\nThe original impulse behind creating this series was the fact that the\nsummary of previously sent commit was quite cryptic, and didn't really\nexplain what it was intended to do.  While at it I have added one more\nsimplification on top of the one proposed by Junio.\n\nThe second path in this series is to have gitweb treat the same\n'blob_plain' view of both *.xhtml (with application/xhtml+xml\nmimetype) and *.html (text/html), when $prevent_xss is on.\n\nJakub Narebski (2):\n  gitweb: Serve text/*  'blob_plain' as text/plain with $prevent_xss\n  gitweb: Serve */*+xml 'blob_plain' as text/plain with $prevent_xss\n\n gitweb/gitweb.perl |   11 ++++++++++-\n 1 files changed, 10 insertions(+), 1 deletions(-)\n\n-- \n1.7.5\n"},{"id":"170705","messageId":"1309426761-819-2-git-send-email-jnareb@gmail.com","threadId":"27734","inReplyTo":"1309426761-819-1-git-send-email-jnareb@gmail.com","subject":"[PATCH 1/2] gitweb: Serve text/* 'blob_plain' as text/plain with $prevent_xss","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2011-06-30T09:39:20Z","receivedAt":"2011-06-30T09:39:20Z","isPatch":true,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"One of mechanism enabled by setting $prevent_xss to true is 'blob_plain'\nview protection.  With XSS prevention on, blobs of all types except a\nfew known safe ones are served with \"Content-Disposition: attachment\" to\nmake sure they don't run in our security domain.\n\nInstead of serving text/* type files, except text/plain (and including\ntext/html), as attachements, downgrade it to text/plain.  This way HTML\npages in 'blob_plain' (raw) wiew would be displayed in browser, but\nsafely as a source, and not asked to be saved.\n\nSigned-off-by: Jakub Narebski <jnareb@gmail.com>\n---\n gitweb/gitweb.perl |   10 +++++++++-\n 1 files changed, 9 insertions(+), 1 deletions(-)\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex 8620aca..cb2e7bc 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -6139,7 +6139,15 @@ sub git_blob_plain {\n \t# want to be sure not to break that by serving the image as an\n \t# attachment (though Firefox 3 doesn't seem to care).\n \tmy $sandbox = $prevent_xss &&\n-\t\t$type !~ m!^(?:text/plain|image/(?:gif|png|jpeg))(?:[ ;]|$)!;\n+\t\t$type !~ m!^(?:text/[a-z]+|image/(?:gif|png|jpeg))(?:[ ;]|$)!;\n+\n+\t# serve text/* as text/plain\n+\tif ($prevent_xss &&\n+\t    $type =~ m!^text/[a-z]+\\b(.*)$!) {\n+\t\tmy $rest = $1;\n+\t\t$rest = defined $rest ? $rest : '';\n+\t\t$type = \"text/plain$rest\";\n+\t}\n \n \tprint $cgi->header(\n \t\t-type => $type,\n-- \n1.7.5\n"},{"id":"170706","messageId":"1309426761-819-3-git-send-email-jnareb@gmail.com","threadId":"27734","inReplyTo":"1309426761-819-1-git-send-email-jnareb@gmail.com","subject":"[PATCHv1 2/2] gitweb: Serve */*+xml 'blob_plain' as text/plain with $prevent_xss","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2011-06-30T09:39:21Z","receivedAt":"2011-06-30T09:39:21Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Enhance usability of 'blob_plain' view protection against XSS attacks\n(enabled by setting $prevent_xss to true) by serving contents inline\nas safe 'text/plain' mimetype where possible, instead of serving with\n\"Content-Disposition: attachment\" to make sure they don't run in\ngitweb's security domain.\n\nThis patch broadens downgrading to 'text/plain' further, to any\n*/*+xml mimetype.  This includes:\n\n  application/xhtml+xml    (*.xhtml, *.xht)\n  application/atom+xml     (*.atom)\n  application/rss+xml      (*.rss)\n  application/mathml+xm    (*.mathml)\n  application/docbook+xml  (*.docbook)\n  image/svg+xml            (*.svg, *.svgz)\n\nProbably most useful is serving XHTML files as text/plain in\n'blob_plain' view, directly viewable.\n\nBecause file with 'image/svg+xml' mimetype can be compressed SVGZ\nfile, we have to check if */*+xml really is text file, via '-T $fd'.\n\nSigned-off-by: Jakub Narebski <jnareb@gmail.com>\n---\nThis patch is new.\n\n gitweb/gitweb.perl |    3 ++-\n 1 files changed, 2 insertions(+), 1 deletions(-)\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex cb2e7bc..ae6244c 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -6143,7 +6143,8 @@ sub git_blob_plain {\n \n \t# serve text/* as text/plain\n \tif ($prevent_xss &&\n-\t    $type =~ m!^text/[a-z]+\\b(.*)$!) {\n+\t    ($type =~ m!^text/[a-z]+\\b(.*)$! ||\n+\t     ($type =~ m!^[a-z]+/[a-z]\\+xml\\b(.*)$! && -T $fd))) {\n \t\tmy $rest = $1;\n \t\t$rest = defined $rest ? $rest : '';\n \t\t$type = \"text/plain$rest\";\n-- \n1.7.5\n"},{"id":"170719","messageId":"7v8vsjqiwk.fsf@alter.siamese.dyndns.org","threadId":"27734","inReplyTo":"1309426761-819-2-git-send-email-jnareb@gmail.com","subject":"Re: [PATCH 1/2] gitweb: Serve text/* 'blob_plain' as text/plain with $prevent_xss","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2011-06-30T18:22:03Z","receivedAt":"2011-06-30T18:22:03Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jakub Narebski <jnareb@gmail.com> writes:\n\n> One of mechanism enabled by setting $prevent_xss to true is 'blob_plain'\n> view protection.  With XSS prevention on, blobs of all types except a\n> few known safe ones are served with \"Content-Disposition: attachment\" to\n> make sure they don't run in our security domain.\n>\n> Instead of serving text/* type files, except text/plain (and including\n> text/html), as attachements, downgrade it to text/plain.  This way HTML\n> pages in 'blob_plain' (raw) wiew would be displayed in browser, but\n\nA new typo \"wiew\" is introduced without touching other parts of the\nmessage. Curious...\n\n> safely as a source, and not asked to be saved.\n>\n> Signed-off-by: Jakub Narebski <jnareb@gmail.com>\n> ---\n>  gitweb/gitweb.perl |   10 +++++++++-\n>  1 files changed, 9 insertions(+), 1 deletions(-)\n>\n> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\n> index 8620aca..cb2e7bc 100755\n> --- a/gitweb/gitweb.perl\n> +++ b/gitweb/gitweb.perl\n> @@ -6139,7 +6139,15 @@ sub git_blob_plain {\n>  \t# want to be sure not to break that by serving the image as an\n>  \t# attachment (though Firefox 3 doesn't seem to care).\n>  \tmy $sandbox = $prevent_xss &&\n> -\t\t$type !~ m!^(?:text/plain|image/(?:gif|png|jpeg))(?:[ ;]|$)!;\n> +\t\t$type !~ m!^(?:text/[a-z]+|image/(?:gif|png|jpeg))(?:[ ;]|$)!;\n> +\n> +\t# serve text/* as text/plain\n> +\tif ($prevent_xss &&\n> +\t    $type =~ m!^text/[a-z]+\\b(.*)$!) {\n> +\t\tmy $rest = $1;\n> +\t\t$rest = defined $rest ? $rest : '';\n> +\t\t$type = \"text/plain$rest\";\n> +\t}\n>  \n>  \tprint $cgi->header(\n>  \t\t-type => $type,\n"}]}