补丁 Rails 3 修复 CSRF 保护漏洞

Question

我目前正在开发一个使用 Rails 3.2 的大型项目，并且没有机会迁移到 Rails 4。据我所知，当您拥有 GET 请求的 JS 视图时，Rails 3 存在 CSRF 保护漏洞。 在 Rails 4 中，此 PR 已修复此问题。

https://github.com/rails/rails/pull/13345/files

有谁知道如何修补 Rails 3 来修复这个漏洞？

Answer 1

您可以对 Rails 3.2 ActionController:: RequestForgeryProtection 模块应用完全相同的更改。

# config/initializers/cross_origin_script_tag_protection.rb

module ActionController
  class InvalidCrossOriginRequest < ActionControllerError
  end

  module RequestForgeryProtection
    module ClassMethods
      def protect_from_forgery(options = {})
        self.request_forgery_protection_token ||= :authenticity_token
        prepend_before_filter :verify_authenticity_token, options
        append_after_action :verify_same_origin_request
      end
    end

    protected

      def verify_authenticity_token
        @marked_for_same_origin_verification = true

        unless verified_request?
          logger.warn "WARNING: Can't verify CSRF token authenticity" if logger
          handle_unverified_request
        end
      end

      CROSS_ORIGIN_JAVASCRIPT_WARNING = "Security warning: an embedded " \
        "<script> tag on another site requested protected JavaScript. " \
        "If you know what you're doing, go ahead and disable forgery " \
        "protection on this action to permit cross-origin JavaScript embedding."
      private_constant :CROSS_ORIGIN_JAVASCRIPT_WARNING

      # If `verify_authenticity_token` was run (indicating that we have
      # forgery protection enabled for this request) then also verify that
      # we aren't serving an unauthorized cross-origin response.
      def verify_same_origin_request
        if marked_for_same_origin_verification? && non_xhr_javascript_response?
          logger.warn CROSS_ORIGIN_JAVASCRIPT_WARNING if logger
          raise ActionController::InvalidCrossOriginRequest, CROSS_ORIGIN_JAVASCRIPT_WARNING
        end
      end

      # If the `verify_authenticity_token` before_action ran, verify that
      # JavaScript responses are only served to same-origin GET requests.
      def marked_for_same_origin_verification?
        defined? @marked_for_same_origin_verification
      end

      # Check for cross-origin JavaScript responses.
      def non_xhr_javascript_response?
        content_type =~ %r(\Atext/javascript) && !request.xhr?
      end
  end
end

如果它适合你，请告诉我。