修补Rails 3以修复CSRF保护漏洞

Patch Rails 3 to fix CSRF protection vulnerability

本文关键字：CSRF 保护 漏洞 Rails 修补      更新时间：2023-09-26

我目前正在做一个使用Rails 3.2的大项目，没有机会转到Rails 4。正如我所知，当您拥有GET请求的JS视图时，Rails3有CSRF保护漏洞。在Rails4中，它是由这个PR修复的。

https://github.com/rails/rails/pull/13345/files

有人知道我如何修补Rails3来修复这个漏洞吗？

您可以对Rails 3.2 ActionController:: RequestForgeryProtection模块应用完全相同的更改。

# config/initializers/cross_origin_script_tag_protection.rb
module ActionController
  class InvalidCrossOriginRequest < ActionControllerError
  end
  module RequestForgeryProtection
    module ClassMethods
      def protect_from_forgery(options = {})
        self.request_forgery_protection_token ||= :authenticity_token
        prepend_before_filter :verify_authenticity_token, options
        append_after_action :verify_same_origin_request
      end
    end
    protected
      def verify_authenticity_token
        @marked_for_same_origin_verification = true
        unless verified_request?
          logger.warn "WARNING: Can't verify CSRF token authenticity" if logger
          handle_unverified_request
        end
      end
      CROSS_ORIGIN_JAVASCRIPT_WARNING = "Security warning: an embedded " '
        "<script> tag on another site requested protected JavaScript. " '
        "If you know what you're doing, go ahead and disable forgery " '
        "protection on this action to permit cross-origin JavaScript embedding."
      private_constant :CROSS_ORIGIN_JAVASCRIPT_WARNING
      # If `verify_authenticity_token` was run (indicating that we have
      # forgery protection enabled for this request) then also verify that
      # we aren't serving an unauthorized cross-origin response.
      def verify_same_origin_request
        if marked_for_same_origin_verification? && non_xhr_javascript_response?
          logger.warn CROSS_ORIGIN_JAVASCRIPT_WARNING if logger
          raise ActionController::InvalidCrossOriginRequest, CROSS_ORIGIN_JAVASCRIPT_WARNING
        end
      end
      # If the `verify_authenticity_token` before_action ran, verify that
      # JavaScript responses are only served to same-origin GET requests.
      def marked_for_same_origin_verification?
        defined? @marked_for_same_origin_verification
      end
      # Check for cross-origin JavaScript responses.
      def non_xhr_javascript_response?
        content_type =~ %r('Atext/javascript) && !request.xhr?
      end
  end
end

请告诉我它是否适合你。

相关文章：