benya/rmm-openwrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sanitize LuCI upstream proxy headers

Browse Source
This commit is contained in:
benya
2026-06-04 19:39:53 +03:00
parent 7048ba615a
commit 072025be54
2 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
server/internal/httpapi/server.go
View File

@@ -1122,6 +1122,15 @@ func (a *App) proxyLuCI(w http.ResponseWriter, r *http.Request, deviceID, sessio
req.Host = "127.0.0.1"
req.Header.Set("Host", "127.0.0.1")
req.Header.Del("Accept-Encoding")
req.Header.Del("Forwarded")
req.Header.Del("X-Forwarded-Host")
req.Header.Del("X-Forwarded-Port")
req.Header.Del("X-Forwarded-Proto")
req.Header.Del("X-Real-IP")
req.Header.Del("Origin")
req.Header.Del("Referer")
// A nil slice tells ReverseProxy not to append the operator address.
req.Header["X-Forwarded-For"] = nil
removeCookie(req, operatorSessionCookie)
removeCookie(req, luciRouteCookie)
}

14
server/internal/httpapi/server_test.go
View File

@@ -412,6 +412,12 @@ func TestLuCIProxyRequiresActiveSessionAndRewritesPaths(t *testing.T) {
http.Error(w, "rejected host", http.StatusForbidden)
return
}
for _, header := range []string{"Forwarded", "X-Forwarded-For", "X-Forwarded-Host", "X-Forwarded-Port", "X-Forwarded-Proto", "X-Real-IP", "Origin", "Referer"} {
if r.Header.Get(header) != "" {
http.Error(w, "rejected forwarded request", http.StatusForbidden)
return
}
}
if strings.Contains(r.Header.Get("Cookie"), "rmm_operator_session=") {
t.Fatal("operator session cookie leaked to LuCI upstream")
}
@@ -478,6 +484,14 @@ func TestLuCIProxyRequiresActiveSessionAndRewritesPaths(t *testing.T) {
t.Fatal(err)
}
req.Header.Set("Authorization", "Bearer operator-test")
req.Header.Set("Forwarded", "for=203.0.113.10;proto=https")
req.Header.Set("X-Forwarded-For", "203.0.113.10")
req.Header.Set("X-Forwarded-Host", "rmm.example.test")
req.Header.Set("X-Forwarded-Port", "443")
req.Header.Set("X-Forwarded-Proto", "https")
req.Header.Set("X-Real-IP", "203.0.113.10")
req.Header.Set("Origin", "https://rmm.example.test")
req.Header.Set("Referer", "https://rmm.example.test/luci/")
resp, err := client.Do(req)
if err != nil {
t.Fatal(err)