Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Improve validation of SNS subscription confirm (#14671) 

An upstream validation bug in the aws-sdk-sns library could enable RCE under certain circumstances. This commit updates the upstream gem, and adds additional validation to provide defense-in-depth.
This commit is contained in:
David Taylor 2021-10-20 22:20:52 +01:00 committed by GitHub
parent 8fb823c30f
commit 010309d108
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Gemfile.lock
View File

@ -53,8 +53,8 @@ GEM
rake (>= 10.4, < 14.0) rake (>= 10.4, < 14.0)
ast (2.4.2) ast (2.4.2)
aws-eventstream (1.2.0) aws-eventstream (1.2.0)
aws-partitions (1.432.0) aws-partitions (1.516.0)
aws-sdk-core (3.112.1) aws-sdk-core (3.121.2)
aws-eventstream (~> 1, >= 1.0.2) aws-eventstream (~> 1, >= 1.0.2)
aws-partitions (~> 1, >= 1.239.0) aws-partitions (~> 1, >= 1.239.0)
aws-sigv4 (~> 1.1) aws-sigv4 (~> 1.1)
@ -66,10 +66,10 @@ GEM
aws-sdk-core (~> 3, >= 3.112.0) aws-sdk-core (~> 3, >= 3.112.0)
aws-sdk-kms (~> 1) aws-sdk-kms (~> 1)
aws-sigv4 (~> 1.1) aws-sigv4 (~> 1.1)
aws-sdk-sns (1.38.0) aws-sdk-sns (1.46.0)
aws-sdk-core (~> 3, >= 3.112.0) aws-sdk-core (~> 3, >= 3.121.2)
aws-sigv4 (~> 1.1) aws-sigv4 (~> 1.1)
aws-sigv4 (1.2.3) aws-sigv4 (1.4.0)
aws-eventstream (~> 1, >= 1.0.2) aws-eventstream (~> 1, >= 1.0.2)
barber (0.12.2) barber (0.12.2)
ember-source (>= 1.0, < 3.1) ember-source (>= 1.0, < 3.1)

9
app/jobs/regular/confirm_sns_subscription.rb
View File

@ -13,8 +13,13 @@ module Jobs
require "aws-sdk-sns" require "aws-sdk-sns"
return unless Aws::SNS::MessageVerifier.new.authentic?(raw) return unless Aws::SNS::MessageVerifier.new.authentic?(raw)
# confirm subscription by visiting the URL uri = begin
open(subscribe_url) URI.parse(subscribe_url)
rescue URI::Error
return
end
Net::HTTP.get(uri)
end end
end end