Page MenuHomePhabricator

Allow only CDN routes when using security.alternate-file-domain
ClosedPublic

Authored by bttelle on Jul 25 2014, 1:48 AM.

Details

Summary

Instead of allowing all routes based on security.alternate-file-domain, now, when security.alternate-file-domain is set, and the request matches this domain, requests are validated against an explicit list. Allowed routes:

  • /res/
  • /file/data/
  • /file/xform/
  • /phame/r/

This will be redone by T5702 to be less of a hack.

Test Plan
  • browse around (incl. Phame live) to make sure there is no regression from this when security.alternate-file-domain is not used.
  • check that celerity resources and files (incl. previews) are served with security.alternate-file-domain set.
  • check that phame live blog is serving its css correctly with security.alternate-file-domain set.
  • check that requests outside of the whitelist generate an exception for security.alternate-file-domain

Diff Detail

Repository
rP Phabricator
Lint
Lint Skipped
Unit
Unit Tests Skipped

Event Timeline

bttelle retitled this revision from to Allow only CDN routes when using security.alternate-file-domain.Jul 25 2014, 1:48 AM
bttelle updated this object.
bttelle edited the test plan for this revision. (Show Details)
bttelle added a reviewer: epriestley.
bttelle updated this revision to Diff 24160.
bttelle edited the test plan for this revision. (Show Details)Jul 25 2014, 1:49 AM
bttelle edited edge metadata.
bttelle updated this object.Jul 25 2014, 1:51 AM

I tested this diff against my own phabricator install with and without secure.alternate-file-domain set.

bttelle edited the test plan for this revision. (Show Details)Jul 25 2014, 2:01 AM
bttelle updated this revision to Diff 24161.Jul 25 2014, 2:14 AM

Normalized indent to two spaces per level.

epriestley edited edge metadata.Jul 25 2014, 1:39 PM
epriestley accepted this revision.

This looks correct to me. Thanks!

This revision is now accepted and ready to land.Jul 25 2014, 1:39 PM
epriestley closed this revision.Jul 25 2014, 1:40 PM
epriestley updated this revision to Diff 24172.

Closed by commit rPc006cca9b1e9 (authored by Joseph Battelle <git@bttelle.com>, committed by @epriestley).