Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add brute force protection on all methods wrapped by PublicShareMiddleware #35057

Merged
merged 1 commit into from
Dec 7, 2022
Merged

Add brute force protection on all methods wrapped by PublicShareMiddleware #35057

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion lib/private/AppFramework/DependencyInjection/DIContainer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -304,7 +304,8 @@ public function __construct($appName, $urlParams = [], ServerContainer $server =
new OC\AppFramework\Middleware\PublicShare\PublicShareMiddleware(
$c->get(IRequest::class),
$c->get(ISession::class),
$c->get(\OCP\IConfig::class)
$c->get(\OCP\IConfig::class),
$c->get(OC\Security\Bruteforce\Throttler::class)
)
);
$dispatcher->registerMiddleware(
Expand Down
22 changes: 21 additions & 1 deletion lib/private/AppFramework/Middleware/PublicShare/PublicShareMiddleware.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
namespace OC\AppFramework\Middleware\PublicShare;

use OC\AppFramework\Middleware\PublicShare\Exceptions\NeedAuthenticationException;
use OC\Security\Bruteforce\Throttler;
use OCP\AppFramework\AuthPublicShareController;
use OCP\AppFramework\Http\NotFoundResponse;
use OCP\AppFramework\Middleware;
Expand All @@ -34,6 +35,7 @@
use OCP\ISession;

class PublicShareMiddleware extends Middleware {

/** @var IRequest */
private $request;

Expand All @@ -43,17 +45,26 @@ class PublicShareMiddleware extends Middleware {
/** @var IConfig */
private $config;

public function __construct(IRequest $request, ISession $session, IConfig $config) {
/** @var Throttler */
private $throttler;

public function __construct(IRequest $request, ISession $session, IConfig $config, Throttler $throttler) {
$this->request = $request;
$this->session = $session;
$this->config = $config;
$this->throttler = $throttler;
}

public function beforeController($controller, $methodName) {
if (!($controller instanceof PublicShareController)) {
return;
}

$controllerClassPath = explode('\\', get_class($controller));
$controllerShortClass = end($controllerClassPath);
$bruteforceProtectionAction = $controllerShortClass . '::' . $methodName;
$this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), $bruteforceProtectionAction);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we read if the controller itself has the annotation and then reuse that action or better not do anything, so it's not double slowed?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically we can, just like the BruteForceMiddleware does.
But as you said, what if the ShareController is handled by the BruteForceMiddleware in the future? sleepDelayOrThrowOnMax would be called twice.

Also it would probably bring some confusion. Why would the PublicShareMiddleware care about annotations that are bruteforce-related?
I think it's fine the way we do it. All methods having the token/password check are bruteforce protected.

Only weird aspect of this is when reading the controllers...nothing mentions bruteforce protection in OCA\Files_Sharing\Controller\PublicShareController and OCA\Files_Sharing\Controller\ShareController.
Should we add explicit comments pointing to the PublicShareMiddleware in those controllers? And/or in the AuthPublicShareController and PublicShareController?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nickvergessen I kinda answered your question 😁. IMO it's fine and clearer like it is now.


if (!$this->isLinkSharingEnabled()) {
throw new NotFoundException('Link sharing is disabled');
}
Expand All @@ -68,6 +79,8 @@ public function beforeController($controller, $methodName) {
$controller->setToken($token);

if (!$controller->isValidToken()) {
$this->throttle($bruteforceProtectionAction, $token);

$controller->shareNotFound();
throw new NotFoundException();
}
Expand All @@ -88,6 +101,7 @@ public function beforeController($controller, $methodName) {
throw new NeedAuthenticationException();
}

$this->throttle($bruteforceProtectionAction, $token);
throw new NotFoundException();
}

Expand Down Expand Up @@ -128,4 +142,10 @@ private function isLinkSharingEnabled(): bool {

return true;
}

private function throttle($bruteforceProtectionAction, $token): void {
$ip = $this->request->getRemoteAddress();
$this->throttler->sleepDelay($ip, $bruteforceProtectionAction);
$this->throttler->registerAttempt($bruteforceProtectionAction, $ip, ['token' => $token]);
}
}
7 changes: 6 additions & 1 deletion tests/lib/AppFramework/Middleware/PublicShare/PublicShareMiddlewareTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@

use OC\AppFramework\Middleware\PublicShare\Exceptions\NeedAuthenticationException;
use OC\AppFramework\Middleware\PublicShare\PublicShareMiddleware;
use OC\Security\Bruteforce\Throttler;
use OCP\AppFramework\AuthPublicShareController;
use OCP\AppFramework\Controller;
use OCP\AppFramework\Http\NotFoundResponse;
Expand All @@ -44,6 +45,8 @@ class PublicShareMiddlewareTest extends \Test\TestCase {
private $session;
/** @var IConfig|\PHPUnit\Framework\MockObject\MockObject */
private $config;
/** @var IConfig|\PHPUnit\Framework\MockObject\MockObject */
private $throttler;

/** @var PublicShareMiddleware */
private $middleware;
Expand All @@ -55,11 +58,13 @@ protected function setUp(): void {
$this->request = $this->createMock(IRequest::class);
$this->session = $this->createMock(ISession::class);
$this->config = $this->createMock(IConfig::class);
$this->throttler = $this->createMock(Throttler::class);

$this->middleware = new PublicShareMiddleware(
$this->request,
$this->session,
$this->config
$this->config,
$this->throttler
);
}

Expand Down