Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Block auto-indexing of static assets more narrowly #8555

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Block auto-indexing of static assets more narrowly #8555

wants to merge 1 commit into from
+12 −22

Commits on Aug 28, 2024

  1. Block auto-indexing of static assets more narrowly 

    In c870cc3, we added rules to 404 instead of serving a 403 or auto-indexing on
static asset directories in automate-ui and dex respectively. The regexes used
are overly broad in that they cause any URIs ending in "dex" or "assets" to
404[1] including unrelated API endpoints. For example, this is blocking us from
publishing policyfiles named "index".

I'm not so familiar with these internals, but I believe it's sufficient to
use regexes `^/dex/` and `^/assets/` etc instead of `.dex` and `.assets` etc. I
also blocked auto-indexing of two other static asset directories under dex
(`fonts` and `font-awesome-*`). I made a note that ideally dex itself should be
handling this.

I'll note that the 404s served at the loadbalancer look different than the 404s
of underlying servers, so an attacker can still know they "hit" something. For
example:

```
$ curl -k -v -H 'Host: chef-automate' 'https://127.0.0.1/dex/foo/bar'
...
< HTTP/2 404
< date: Wed, 28 Aug 2024 17:35:03 GMT
< content-type: text/plain; charset=utf-8
< content-length: 19
< x-content-type-options: nosniff
< x-xss-protection: 1; mode=block
< x-content-type-options: nosniff
<
404 page not found
$ curl -k -v -H 'Host: chef-automate' 'https://127.0.0.1/dex/static'
< HTTP/2 404
< date: Wed, 28 Aug 2024 17:35:55 GMT
< content-type: text/html
< content-length: 146
< x-xss-protection: 1; mode=block
< strict-transport-security: max-age=63072000; includeSubDomains
< x-content-type-options: nosniff
<
<html>
<head><title>404 Not Found</title></head>
<body>
<center><h1>404 Not Found</h1></center>
<hr><center>nginx</center>
</body>
</html>
```

At least it doesn't auto-index, but I do question the integrity of this
approach. As I stated above it should be handled by dex itself. I suspect
there's a way to handle the automate-ui assets more elegantly as well.

[1]: https://community.progress.com/s/article/Paths-or-URIs-ending-with-dex-or-assets-Lead-to-a-404-in-Chef-Automate

Signed-off-by: Adam Saponara <[email protected]>
    @adsr
    adsr committed Aug 28, 2024
    Configuration menu
    Copy the full SHA
    4900587 View commit details
    Browse the repository at this point in the history