From bb228d14560a61cf9e3b2e80e3e9d1932e55e9ac Mon Sep 17 00:00:00 2001 From: Marcin Rataj Date: Tue, 17 Dec 2019 02:11:35 +0100 Subject: [PATCH] fix: limit SW registration to content root Introduces hardening proposed in: https://github.com/ipfs/go-ipfs/issues/4025#issuecomment-342250616 License: MIT Signed-off-by: Marcin Rataj This commit was moved from ipfs/kubo@455e49835500fb46053f68d1236a103d75db18df --- gateway/core/corehttp/gateway_handler.go | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/gateway/core/corehttp/gateway_handler.go b/gateway/core/corehttp/gateway_handler.go index d3cca5d3d..a828b9f5f 100644 --- a/gateway/core/corehttp/gateway_handler.go +++ b/gateway/core/corehttp/gateway_handler.go @@ -8,6 +8,7 @@ import ( "net/http" "net/url" gopath "path" + "regexp" "runtime/debug" "strings" "time" @@ -151,6 +152,18 @@ func (i *gatewayHandler) getOrHeadHandler(w http.ResponseWriter, r *http.Request ipnsHostname = true } + // Service Worker registration request + if r.Header.Get("Service-Worker") == "script" { + // Disallow Service Worker registration on namespace roots + // https://github.com/ipfs/go-ipfs/issues/4025 + matched, _ := regexp.MatchString(`^/ip[fn]s/[^/]+$`, r.URL.Path) + if matched { + err := fmt.Errorf("registration is not allowed for this scope") + webError(w, "navigator.serviceWorker", err, http.StatusBadRequest) + return + } + } + parsedPath := ipath.New(urlPath) if err := parsedPath.IsValid(); err != nil { webError(w, "invalid ipfs path", err, http.StatusBadRequest)