Distros: Harden security

[ysangkok]

• Require distro maintainer group membership for some distro endpoints,
  require admin for others
• Require that URIs start with "https:" to prevent e.g. having
  "javascript:" in there

Test

If you try to update packages now, you need group membership first:

% curl admin:admin@localhost:8080/distro/Mandriva/packages.csv -X PUT --data-binary "testpkg,0.1,httpjavascript:alert(1)<>{}()" -H "Content-type: text/csv"
Distribution does not exist

Admins can make users distro maintainers. Here, the admin makes themselves a distro maintainer for Mandriva:

% curl admin:admin@localhost:8080/distro/Mandriva/maintainers/user/admin -X PUT -D - -u admin

Now, let's say the distro maintainer tries to upload some malicious url, it will be rejected:

% curl admin:admin@localhost:8080/distro/Mandriva/packages.csv -X PUT --data-binary "testpkg,0.1,httpjavascript:alert(1)<>{}()" -H "Content-type: text/csv"
Could not parse CSV File to a distro package list: Invalid distro package entry: ["testpkg","0.1","httpjavascript:alert(1)<>{}()"]

The URI must start with "https:", and it can be accepted:

% curl admin:admin@localhost:8080/distro/Mandriva/packages.csv -X PUT --data-binary "testpkg,0.1,https://example.com" -H "Content-type: text/csv"
Ok!

Admins can also remove distro maintainership:

% curl admin:admin@localhost:8080/distro/Mandriva/maintainers/user/admin -X DELETE -D - -u admin

Now, the given user can no longer upload, even if the data is valid:

% curl admin:admin@localhost:8080/distro/Mandriva/packages.csv -X PUT --data-binary "testpkg,0.1,https://example2.com" -H "Content-type: text/csv"
Forbidden: No access for this resource.