Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add mitigation against BREACH #18254

Merged
merged 2 commits into from
Aug 24, 2015
Merged

Add mitigation against BREACH #18254

merged 2 commits into from
Aug 24, 2015

Commits on Aug 13, 2015

  1. Add mitigation against BREACH 

    While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:

1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data

Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.

To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
    @LukasReschke
    LukasReschke committed Aug 13, 2015
    Configuration menu
    Copy the full SHA
    8313a3f View commit details
    Browse the repository at this point in the history

  2. Remove search box $_POST since it is unused

    @LukasReschke
    LukasReschke committed Aug 13, 2015
    Configuration menu
    Copy the full SHA
    df2ce8a View commit details
    Browse the repository at this point in the history