requests: assert that theres no @ in the URLs authority

[pve-http-server.git] / src / PVE / APIServer / AnyEvent.pm

diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm
index cd4a50d775c014b58f59a30c01781621d97c125f..9de623815b2ddfea50a7647e87e51005cc668ff7 100644 (file)
--- a/src/PVE/APIServer/AnyEvent.pm
+++ b/src/PVE/APIServer/AnyEvent.pm
@@ -293,11 +293,18 @@ sub response {
 
     my $code = $resp->code;
     my $msg = $resp->message || HTTP::Status::status_message($code);
-    ($msg) = $msg =~m/^(.*)$/m;
     my $content = $resp->content;
 
+    # multiline mode only checks \n for $, so explicitly check for any \n or \r afterwards
+    ($msg) = $msg =~ m/^(.*)$/m;
+    if ($msg =~ /[\r\n]/) {
+       $code = 400; # bad request from user
+       $msg = HTTP::Status::status_message($code);
+       $content = '';
+    }
+
     if ($code =~ /^(1\d\d|[23]04)$/) {
-       # make sure content we have no content
+       # make sure informational, no content and not modified response send no content
        $content = "";
     }
 
@@ -695,10 +702,20 @@ sub proxy_request {
     eval {
        my $target;
        my $keep_alive = 1;
+
+       # stringify URI object and verify it starts with a slash
+       $uri = "$uri";
+       if ($uri !~ m@^/@) {
+           $self->error($reqstate, 400, "invalid proxy uri");
+           return;
+       }
+
+       my $may_stream_file;
        if ($host eq 'localhost') {
            $target = "http://$host:85$uri";
            # keep alive for localhost is not worth (connection setup is about 0.2ms)
            $keep_alive = 0;
+           $may_stream_file = 1;
        } elsif (Net::IP::ip_is_ipv6($host)) {
            $target = "https://[$host]:8006$uri";
        } else {
@@ -784,6 +801,10 @@ sub proxy_request {
                        $header->header(Location => $location);
                    }
                    if ($stream) {
+                       if (!$may_stream_file) {
+                           $self->error($reqstate, 403, 'streaming denied');
+                           return;
+                       }
                        sysopen(my $fh, "$stream", O_NONBLOCK | O_RDONLY)
                            or die "open stream path '$stream' for forwarding failed: $!\n";
                        my $resp = HTTP::Response->new($code, $msg, $header, undef);
@@ -1553,6 +1574,11 @@ sub push_request_header {
                        $self->error($reqstate, 506, "http protocol version $maj.$min not supported");
                        return;
                    }
+                   if ($url =~ m|^[^/]*@|) {
+                       # if an '@' comes before the first slash proxy forwarding might consider
+                       # the frist part of the url to be part of an authority...
+                       $self->error($reqstate, 400, "invalid url");
+                   }
 
                    $self->{request_count}++; # only count valid request headers
                    if ($self->{request_count} >= $self->{max_requests}) {
@@ -1889,6 +1915,9 @@ sub new {
            honor_cipher_order => 1,
        };
 
+       # workaround until anyevent supports TLS 1.3 ciphersuites directly
+       my $ciphersuites = delete $self->{ssl}->{ciphersuites};
+
        foreach my $k (keys %$ssl_defaults) {
            $self->{ssl}->{$k} //= $ssl_defaults->{$k};
        }
@@ -1905,9 +1934,18 @@ sub new {
        if (delete $self->{ssl}->{honor_cipher_order}) {
            $tls_ctx_flags |= &Net::SSLeay::OP_CIPHER_SERVER_PREFERENCE;
        }
+       # workaround until anyevent supports disabling TLS 1.3 directly
+       if (exists($self->{ssl}->{tlsv1_3}) && !$self->{ssl}->{tlsv1_3}) {
+           $tls_ctx_flags |= &Net::SSLeay::OP_NO_TLSv1_3;
+       }
+
 
        $self->{tls_ctx} = AnyEvent::TLS->new(%{$self->{ssl}});
        Net::SSLeay::CTX_set_options($self->{tls_ctx}->{ctx}, $tls_ctx_flags);
+       if (defined($ciphersuites)) {
+           warn "Failed to set TLS 1.3 ciphersuites '$ciphersuites'\n"
+               if !Net::SSLeay::CTX_set_ciphersuites($self->{tls_ctx}->{ctx}, $ciphersuites);
+       }
     }
 
     if ($self->{spiceproxy}) {