Page MenuHomePhabricator

Allow only CDN routes when using security.alternate-file-domain
ClosedPublic

Authored by bttelle on Jul 25 2014, 1:48 AM.
Tags
None
Referenced Files
Unknown Object (File)
Feb 4 2024, 6:36 PM
Unknown Object (File)
Jan 3 2024, 7:42 PM
Unknown Object (File)
Dec 31 2023, 9:57 AM
Unknown Object (File)
Dec 31 2023, 9:56 AM
Unknown Object (File)
Dec 31 2023, 9:56 AM
Unknown Object (File)
Dec 30 2023, 6:25 PM
Unknown Object (File)
Dec 26 2023, 8:28 PM
Unknown Object (File)
Dec 23 2023, 3:02 PM
Subscribers

Details

Summary

Instead of allowing all routes based on security.alternate-file-domain, now, when security.alternate-file-domain is set, and the request matches this domain, requests are validated against an explicit list. Allowed routes:

  • /res/
  • /file/data/
  • /file/xform/
  • /phame/r/

This will be redone by T5702 to be less of a hack.

Test Plan
  • browse around (incl. Phame live) to make sure there is no regression from this when security.alternate-file-domain is not used.
  • check that celerity resources and files (incl. previews) are served with security.alternate-file-domain set.
  • check that phame live blog is serving its css correctly with security.alternate-file-domain set.
  • check that requests outside of the whitelist generate an exception for security.alternate-file-domain

Diff Detail

Repository
rP Phabricator
Branch
cdnroutes
Lint
Lint Passed
Unit
Tests Passed
Build Status
Buildable 1892
Build 1893: [Placeholder Plan] Wait for 30 Seconds

Event Timeline

bttelle retitled this revision from to Allow only CDN routes when using security.alternate-file-domain.
bttelle updated this object.
bttelle edited the test plan for this revision. (Show Details)
bttelle added a reviewer: epriestley.
bttelle edited edge metadata.

I tested this diff against my own phabricator install with and without secure.alternate-file-domain set.

Normalized indent to two spaces per level.

epriestley edited edge metadata.

This looks correct to me. Thanks!

This revision is now accepted and ready to land.Jul 25 2014, 1:39 PM
epriestley updated this revision to Diff 24172.

Closed by commit rPc006cca9b1e9 (authored by Joseph Battelle <git@bttelle.com>, committed by @epriestley).