Ticket #16010: crsf-origin-check.diff

django/middleware/csrf.py

@@ -25 +25 @@
     randrange = random.randrange
 _MAX_CSRF_KEY = 18446744073709551616L     # 2 << 63
 
+REASON_BAD_ORIGIN = "Origin checking failed - %s does not match %s."
 REASON_NO_REFERER = "Referer checking failed - no Referer."
 REASON_BAD_REFERER = "Referer checking failed - %s does not match %s."
 REASON_NO_CSRF_COOKIE = "CSRF cookie not set."
@@ -115 +116 @@
                 # any branches that call reject()
                 return self._accept(request)
 
+            # Note that request.get_host() includes the port
+            good_origin = '%s://%s' % (request.is_secure() and 'https' or 'http',
+                                       request.get_host())
+
+            if 'HTTP_ORIGIN' in request.META:
+                # Cookies are unreliable when there are untrusted sites on sibling
+                # domains. foo.example.com can set a cookie scoped to .example.com
+                # that is then visible to bar.example.com. There is a proposal for a
+                # new Origin header which should be a better CSRF check. When the
+                # browser supports it, verify the match. It is currently implemented
+                # by WebKit-based browsers, and Mozilla has a ticket to add support.
+                origin = request.META['HTTP_ORIGIN']
+                if good_origin != origin:
+                    reason = REASON_BAD_ORIGIN % (origin, good_origin)
+                    logger.warning('Forbidden (%s): %s' % (reason, request.path),
+                        extra={
+                            'status_code': 403,
+                            'request': request,
+                        }
+                    )
+                    return self._reject(request, reason)
+
             if request.is_secure():
                 # Suppose user visits http://example.com/
                 # An active network attacker,(man-in-the-middle, MITM) sends a
@@ -141 +164 @@
                     )
                     return self._reject(request, REASON_NO_REFERER)
 
-                # Note that request.get_host() includes the port
-                good_referer = 'https://%s/' % request.get_host()
-                if not same_origin(referer, good_referer):
-                    reason = REASON_BAD_REFERER % (referer, good_referer)
+                if not same_origin(referer, good_origin):
+                    reason = REASON_BAD_REFERER % (referer, good_origin)
                     logger.warning('Forbidden (%s): %s' % (reason, request.path),
                         extra={
                             'status_code': 403,

docs/ref/contrib/csrf.txt

@@ -213 +213 @@
    done for HTTP requests because the presence of the Referer header is not
    reliable enough under HTTP.)
 
+5. When the browser provides the `Origin header`_, it is checked for the correct
+   origin as in the referer checking above.  This provides protection against
+   cross-subdomain attacks for browsers which implement the header.
+
+.. _Origin header: http://www.ietf.org/id/draft-ietf-websec-origin-00.txt
+
 This ensures that only forms that have originated from your Web site can be used
 to POST data back.
 

tests/regressiontests/csrf_tests/tests.py

@@ -51 +51 @@
     _csrf_id = "1"
 
     def _get_GET_no_csrf_cookie_request(self):
-        return TestingHttpRequest()
+        req = TestingHttpRequest()
+        # Include some host so request.get_host() doesn't error.
+        req.META['HTTP_HOST'] = 'www.example.com'
+        return req
 
     def _get_GET_csrf_cookie_request(self):
         req = TestingHttpRequest()
+        # Include some host so request.get_host() doesn't error.
+        req.META['HTTP_HOST'] = 'www.example.com'
         req.COOKIES[settings.CSRF_COOKIE_NAME] = self._csrf_id_cookie
         return req
 
@@ -249 +254 @@
         req.META['HTTP_REFERER'] = 'https://www.example.com'
         req2 = CsrfViewMiddleware().process_view(req, post_form_view, (), {})
         self.assertEqual(None, req2)
+
+    def test_bad_origin(self):
+        """
+        Test that a request with a bad origin is rejected
+        """
+        req = self._get_POST_request_with_token()
+        req.META['HTTP_HOST'] = 'www.example.com'
+        req.META['HTTP_ORIGIN'] = 'https://www.evil.org'
+        req2 = CsrfViewMiddleware().process_view(req, post_form_view, (), {})
+        self.assertNotEqual(None, req2)
+        self.assertEqual(403, req2.status_code)
+
+    def test_bad_origin_2(self):
+        """
+        Test that a request with a null origin is rejected
+        """
+        req = self._get_POST_request_with_token()
+        req.META['HTTP_HOST'] = 'www.example.com'
+        req.META['HTTP_ORIGIN'] = 'null'
+        req2 = CsrfViewMiddleware().process_view(req, post_form_view, (), {})
+        self.assertNotEqual(None, req2)
+        self.assertEqual(403, req2.status_code)
+
+    def test_bad_origin_3(self):
+        """
+        Test that a request with an origin with wrong protocol is rejected
+        """
+        req = self._get_POST_request_with_token()
+        req._is_secure = True
+        req.META['HTTP_HOST'] = 'www.example.com'
+        req.META['HTTP_ORIGIN'] = 'http://example.com'
+        req2 = CsrfViewMiddleware().process_view(req, post_form_view, (), {})
+        self.assertNotEqual(None, req2)
+        self.assertEqual(403, req2.status_code)
+
+    def test_good_origin(self):
+        """
+        Test that a POST HTTP request with a good origin is accepted
+        """
+        req = self._get_POST_request_with_token()
+        req.META['HTTP_HOST'] = 'www.example.com'
+        req.META['HTTP_ORIGIN'] = 'http://www.example.com'
+        req2 = CsrfViewMiddleware().process_view(req, post_form_view, (), {})
+        self.assertEqual(None, req2)
+
+    def test_good_origin_2(self):
+        """
+        Test that a POST HTTPS request with a good origin is accepted
+        """
+        req = self._get_POST_request_with_token()
+        req._is_secure = True
+        req.META['HTTP_HOST'] = 'www.example.com'
+        req.META['HTTP_ORIGIN'] = 'https://www.example.com'
+        req.META['HTTP_REFERER'] = 'https://www.example.com/somepage'
+        req2 = CsrfViewMiddleware().process_view(req, post_form_view, (), {})
+        self.assertEqual(None, req2)