LBRYCommunity/lbry-sdk
1
0
Fork 1
Code Issues Pull requests Projects Releases 282 Packages Wiki Activity

Origin: null no longer allowed

Browse source
This commit is contained in:
Lex Berezhny 2020-06-03 14:19:16 -04:00
parent f3ee6603de
commit 7296c7df1a
2 changed files with 9 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
lbry/extras/daemon/security.py
View file

@ -23,7 +23,9 @@ def ensure_request_allowed(request, conf):
def is_request_allowed(request, conf) -> bool: def is_request_allowed(request, conf) -> bool:
origin = request.headers.get('Origin', 'null') origin = request.headers.get('Origin')
if origin == 'null' or conf.allowed_origin in ('*', origin): return (
return True origin is None or
return False origin == conf.allowed_origin or
conf.allowed_origin == '*'
)

7
tests/unit/lbrynet_daemon/test_allowed_origin.py
View file

@ -12,11 +12,10 @@ class TestAllowedOrigin(unittest.TestCase):
def test_allowed_origin_default(self): def test_allowed_origin_default(self):
conf = Config() conf = Config()
# no Origin is always allowed # lack of Origin is always allowed
self.assertTrue(allowed(request('GET', '/'), conf)) self.assertTrue(allowed(request('GET', '/'), conf))
# some clients send Origin: null (eg, https://github.com/electron/electron/issues/7931)
self.assertTrue(allowed(request('GET', '/', headers={'Origin': 'null'}), conf))
# deny all other Origins # deny all other Origins
self.assertFalse(allowed(request('GET', '/', headers={'Origin': 'null'}), conf))
self.assertFalse(allowed(request('GET', '/', headers={'Origin': 'localhost'}), conf)) self.assertFalse(allowed(request('GET', '/', headers={'Origin': 'localhost'}), conf))
self.assertFalse(allowed(request('GET', '/', headers={'Origin': 'hackers.com'}), conf)) self.assertFalse(allowed(request('GET', '/', headers={'Origin': 'hackers.com'}), conf))
@ -32,8 +31,8 @@ class TestAllowedOrigin(unittest.TestCase):
conf = Config(allowed_origin='localhost') conf = Config(allowed_origin='localhost')
# no origin and only localhost are allowed # no origin and only localhost are allowed
self.assertTrue(allowed(request('GET', '/'), conf)) self.assertTrue(allowed(request('GET', '/'), conf))
self.assertTrue(allowed(request('GET', '/', headers={'Origin': 'null'}), conf))
self.assertTrue(allowed(request('GET', '/', headers={'Origin': 'localhost'}), conf)) self.assertTrue(allowed(request('GET', '/', headers={'Origin': 'localhost'}), conf))
self.assertFalse(allowed(request('GET', '/', headers={'Origin': 'null'}), conf))
self.assertFalse(allowed(request('GET', '/', headers={'Origin': 'hackers.com'}), conf)) self.assertFalse(allowed(request('GET', '/', headers={'Origin': 'hackers.com'}), conf))
def test_ensure_default(self): def test_ensure_default(self):