sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #9330 from owncloud/update-reva

Browse Source 
[full-ci] chore: update reva to latest edge
This commit is contained in:
Michael Barz
2024-06-11 17:56:40 +02:00
committed by GitHub
parent e0c50baffd fc0b3fe1c2
commit 774efdbd85
12 changed files with 123 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/get.go
Generated Vendored
+16 -6
View File
@@ -131,7 +131,19 @@ func (s *svc) handleGet(ctx context.Context, w http.ResponseWriter, r *http.Requ
}
defer httpRes.Body.Close()
copyHeader(w.Header(), httpRes.Header)
// copy only the headers relevant for the content served by the datagateway
// more headers are already present from the GET request
copyHeader(w.Header(), httpRes.Header, net.HeaderContentType)
copyHeader(w.Header(), httpRes.Header, net.HeaderContentLength)
copyHeader(w.Header(), httpRes.Header, net.HeaderContentRange)
copyHeader(w.Header(), httpRes.Header, net.HeaderOCFileID)
copyHeader(w.Header(), httpRes.Header, net.HeaderOCETag)
copyHeader(w.Header(), httpRes.Header, net.HeaderOCChecksum)
copyHeader(w.Header(), httpRes.Header, net.HeaderETag)
copyHeader(w.Header(), httpRes.Header, net.HeaderLastModified)
copyHeader(w.Header(), httpRes.Header, net.HeaderAcceptRanges)
copyHeader(w.Header(), httpRes.Header, net.HeaderContentDisposistion)
w.WriteHeader(httpRes.StatusCode)
if httpRes.StatusCode != http.StatusOK && httpRes.StatusCode != http.StatusPartialContent {
@@ -156,11 +168,9 @@ func (s *svc) handleGet(ctx context.Context, w http.ResponseWriter, r *http.Requ
// TODO we need to send the If-Match etag in the GET to the datagateway to prevent race conditions between stating and reading the file
}
func copyHeader(dst, src http.Header) {
for key, values := range src {
for i := range values {
dst.Add(key, values[i])
}
func copyHeader(dist, src http.Header, header string) {
if src.Get(header) != "" {
dist.Set(header, src.Get(header))
}
}
vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocdav/ocdav.go
Generated Vendored
-24
View File
@@ -165,8 +165,6 @@ func (s *svc) Handler() http.Handler {
ctx := r.Context()
log := appctx.GetLogger(ctx)
addAccessHeaders(w, r)
// TODO(jfd): do we need this?
// fake litmus testing for empty namespace: see https://github.com/golang/net/blob/e514e69ffb8bc3c76a71ae40de0118d794855992/webdav/litmus_test_server.go#L58-L89
if r.Header.Get(net.HeaderLitmus) == "props: 3 (propfind_invalid2)" {
@@ -284,28 +282,6 @@ func (s *svc) ApplyLayout(ctx context.Context, ns string, useLoggedInUserNS bool
return templates.WithUser(u, ns), requestPath, nil
}
func addAccessHeaders(w http.ResponseWriter, r *http.Request) {
headers := w.Header()
// all resources served via the DAV endpoint should have the strictest possible as default
headers.Set("Content-Security-Policy", "default-src 'none';")
// disable sniffing the content type for IE
headers.Set("X-Content-Type-Options", "nosniff")
// https://msdn.microsoft.com/en-us/library/jj542450(v=vs.85).aspx
headers.Set("X-Download-Options", "noopen")
// Disallow iFraming from other domains
headers.Set("X-Frame-Options", "SAMEORIGIN")
// https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
headers.Set("X-Permitted-Cross-Domain-Policies", "none")
// https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
headers.Set("X-Robots-Tag", "none")
// enforce browser based XSS filters
headers.Set("X-XSS-Protection", "1; mode=block")
if r.TLS != nil {
headers.Set("Strict-Transport-Security", "max-age=63072000")
}
}
func authContextForUser(client gateway.GatewayAPIClient, userID *userpb.UserId, machineAuthAPIKey string) (context.Context, error) {
if machineAuthAPIKey == "" {
return nil, errtypes.NotSupported("machine auth not configured")
vendor/github.com/unrolled/secure/README.md
Generated Vendored
+18 -16
View File
@@ -20,19 +20,21 @@ var myHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
func main() {
secureMiddleware := secure.New(secure.Options{
AllowedHosts: []string{"example\\.com", ".*\\.example\\.com"},
AllowedHostsAreRegex: true,
HostsProxyHeaders: []string{"X-Forwarded-Host"},
SSLRedirect: true,
SSLHost: "ssl.example.com",
SSLProxyHeaders: map[string]string{"X-Forwarded-Proto": "https"},
STSSeconds: 31536000,
STSIncludeSubdomains: true,
STSPreload: true,
FrameDeny: true,
ContentTypeNosniff: true,
BrowserXssFilter: true,
ContentSecurityPolicy: "script-src $NONCE",
AllowedHosts: []string{"example\\.com", ".*\\.example\\.com"},
AllowedHostsAreRegex: true,
HostsProxyHeaders: []string{"X-Forwarded-Host"},
SSLRedirect: true,
SSLHost: "ssl.example.com",
SSLProxyHeaders: map[string]string{"X-Forwarded-Proto": "https"},
STSSeconds: 31536000,
STSIncludeSubdomains: true,
STSPreload: true,
FrameDeny: true,
ContentTypeNosniff: true,
BrowserXssFilter: true,
ContentSecurityPolicy: "script-src $NONCE",
PermittedCrossDomainPolicies: "none",
RobotTag: "noindex",
})
app := secureMiddleware.Handler(myHandler)
@@ -42,7 +44,7 @@ func main() {
Be sure to include the Secure middleware as close to the top (beginning) as possible (but after logging and recovery). It's best to do the allowed hosts and SSL check before anything else.
The above example will only allow requests with a host name of 'example.com', or 'ssl.example.com'. Also if the request is not HTTPS, it will be redirected to HTTPS with the host name of 'ssl.example.com'.
The above example will only allow requests with a host name of 'example.com', or 'ssl.example.com'. Also, if the request is not HTTPS, it will be redirected to HTTPS with the host name of 'ssl.example.com'.
Once those requirements are satisfied, it will add the following headers:
~~~ go
Strict-Transport-Security: 31536000; includeSubdomains; preload
@@ -53,7 +55,7 @@ Content-Security-Policy: script-src 'nonce-a2ZobGFoZg=='
~~~
### Set the `IsDevelopment` option to `true` when developing!
When `IsDevelopment` is true, the AllowedHosts, SSLRedirect, and STS header will not be in effect. This allows you to work in development/test mode and not have any annoying redirects to HTTPS (ie. development can happen on HTTP), or block `localhost` has a bad host.
When `IsDevelopment` is true, the AllowedHosts, SSLRedirect, and STS header will not be in effect. This allows you to work in development/test mode and not have any annoying redirects to HTTPS (i.e. development can happen on HTTP), or block `localhost` has a bad host.
### Available options
Secure comes with a variety of configuration options (Note: these are not the default option values. See the defaults below.):
@@ -137,7 +139,7 @@ http.Error(w, "Bad Request", http.StatusBadRequest)
Call `secure.SetBadRequestHandler` to set your own custom handler.
### Allow Request Function
Secure allows you to set a custom function (`func(r *http.Request) bool`) for the `AllowRequestFunc` option. You can use this function as a custom filter to allow the request to continue or simply reject it. This can be handy if you need to do any dynamic filtering on any of the request properties. It should be noted that this function will be called on every request, so be sure to make your checks quick and not relying on time consuming external calls (or you will be slowing down all requests). See above on how to set a custom handler for the rejected requests.
Secure allows you to set a custom function (`func(r *http.Request) bool`) for the `AllowRequestFunc` option. You can use this function as a custom filter to allow the request to continue or simply reject it. This can be handy if you need to do any dynamic filtering on any of the request properties. It should be noted that this function will be called on every request, so be sure to make your checks quick and not relying on time-consuming external calls (or you will be slowing down all requests). See above on how to set a custom handler for the rejected requests.
### Redirecting HTTP to HTTPS
If you want to redirect all HTTP requests to HTTPS, you can use the following example.
vendor/github.com/unrolled/secure/cspbuilder/builder.go
Generated Vendored
+6 -3
View File
@@ -45,7 +45,7 @@ const (
)
type Builder struct {
Directives map[string]([]string)
Directives map[string][]string
}
// MustBuild is like Build but panics if an error occurs.
@@ -61,12 +61,15 @@ func (builder *Builder) MustBuild() string {
// Build creates a content security policy string from the specified directives.
// If any directive contains invalid values, an error is returned instead.
func (builder *Builder) Build() (string, error) {
var sb strings.Builder
var keys []string
keys := make([]string, 0, len(builder.Directives))
for k := range builder.Directives {
keys = append(keys, k)
}
sort.Strings(keys)
var sb strings.Builder
for _, directive := range keys {
if sb.Len() > 0 {
sb.WriteString("; ")
vendor/github.com/unrolled/secure/secure.go
Generated Vendored
+40 -22
View File
@@ -2,6 +2,7 @@ package secure
import (
"context"
"errors"
"fmt"
"net/http"
"regexp"
@@ -11,22 +12,23 @@ import (
type secureCtxKey string
const (
stsHeader = "Strict-Transport-Security"
stsSubdomainString = "; includeSubDomains"
stsPreloadString = "; preload"
frameOptionsHeader = "X-Frame-Options"
frameOptionsValue = "DENY"
contentTypeHeader = "X-Content-Type-Options"
contentTypeValue = "nosniff"
xssProtectionHeader = "X-XSS-Protection"
xssProtectionValue = "1; mode=block"
cspHeader = "Content-Security-Policy"
cspReportOnlyHeader = "Content-Security-Policy-Report-Only"
hpkpHeader = "Public-Key-Pins"
referrerPolicyHeader = "Referrer-Policy"
featurePolicyHeader = "Feature-Policy"
permissionsPolicyHeader = "Permissions-Policy"
coopHeader = "Cross-Origin-Opener-Policy"
stsHeader = "Strict-Transport-Security"
stsSubdomainString = "; includeSubDomains"
stsPreloadString = "; preload"
frameOptionsHeader = "X-Frame-Options"
frameOptionsValue = "DENY"
contentTypeHeader = "X-Content-Type-Options"
contentTypeValue = "nosniff"
xssProtectionHeader = "X-XSS-Protection"
xssProtectionValue = "1; mode=block"
cspHeader = "Content-Security-Policy"
cspReportOnlyHeader = "Content-Security-Policy-Report-Only"
referrerPolicyHeader = "Referrer-Policy"
featurePolicyHeader = "Feature-Policy"
permissionsPolicyHeader = "Permissions-Policy"
coopHeader = "Cross-Origin-Opener-Policy"
robotTagHeader = "X-Robots-Tag"
permittedCrossDomainPoliciesHeader = "X-Permitted-Cross-Domain-Policies"
ctxDefaultSecureHeaderKey = secureCtxKey("SecureResponseHeader")
cspNonceSize = 16
@@ -65,7 +67,7 @@ type Options struct {
SSLRedirect bool
// If SSLForceHost is true and SSLHost is set, requests will be forced to use SSLHost even the ones that are already using SSL. Default is false.
SSLForceHost bool
// If SSLTemporaryRedirect is true, the a 302 will be used while redirecting. Default is false (301).
// If SSLTemporaryRedirect is true, a 302 will be used while redirecting. Default is false (301).
SSLTemporaryRedirect bool
// If STSIncludeSubdomains is set to true, the `includeSubdomains` will be appended to the Strict-Transport-Security header. Default is false.
STSIncludeSubdomains bool
@@ -110,9 +112,15 @@ type Options struct {
STSSeconds int64
// SecureContextKey allows a custom key to be specified for context storage.
SecureContextKey string
// PermittedCrossDomainPolicies allows to set the X-Permitted-Cross-Domain-Policies header
// Reference https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
PermittedCrossDomainPolicies string
// RobotTag allows to set the X-Robot-Tag header
// Reference https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag
RobotTag string
}
// Secure is a middleware that helps setup a few basic security features. A single secure.Options struct can be
// Secure is a middleware that helps set up a few basic security features. A single secure.Options struct can be
// provided to configure which features should be enabled, and the ability to override a few of the default values.
type Secure struct {
// Customize Secure with an Options struct.
@@ -354,7 +362,7 @@ func (s *Secure) processRequest(w http.ResponseWriter, r *http.Request) (http.He
http.Redirect(w, r, url.String(), status)
return nil, nil, fmt.Errorf("redirecting to HTTPS")
return nil, nil, errors.New("redirecting to HTTPS")
}
if s.opt.SSLForceHost {
@@ -380,7 +388,7 @@ func (s *Secure) processRequest(w http.ResponseWriter, r *http.Request) (http.He
http.Redirect(w, r, url.String(), status)
return nil, nil, fmt.Errorf("redirecting to HTTPS")
return nil, nil, errors.New("redirecting to HTTPS")
}
}
@@ -388,7 +396,7 @@ func (s *Secure) processRequest(w http.ResponseWriter, r *http.Request) (http.He
if s.opt.AllowRequestFunc != nil && !s.opt.AllowRequestFunc(r) {
s.badRequestHandler.ServeHTTP(w, r)
return nil, nil, fmt.Errorf("request not allowed")
return nil, nil, errors.New("request not allowed")
}
// Create our header container.
@@ -466,6 +474,16 @@ func (s *Secure) processRequest(w http.ResponseWriter, r *http.Request) (http.He
responseHeader.Set(coopHeader, s.opt.CrossOriginOpenerPolicy)
}
// X-Permitted-Cross-Domain-Policies
if len(s.opt.PermittedCrossDomainPolicies) > 0 {
responseHeader.Set(permittedCrossDomainPoliciesHeader, s.opt.PermittedCrossDomainPolicies)
}
// X-Robots-Tag
if len(s.opt.RobotTag) > 0 {
responseHeader.Set(robotTagHeader, s.opt.RobotTag)
}
return responseHeader, r, nil
}
@@ -497,7 +515,7 @@ func (s *Secure) ModifyResponseHeaders(res *http.Response) error {
location := res.Header.Get("Location")
if s.isSSL(res.Request) &&
len(s.opt.SSLHost) > 0 &&
(strings.HasPrefix(location, fmt.Sprintf("http://%s/", s.opt.SSLHost)) || location == fmt.Sprintf("http://%s", s.opt.SSLHost)) {
(strings.HasPrefix(location, fmt.Sprintf("http://%s/", s.opt.SSLHost)) || location == "http://"+s.opt.SSLHost) {
location = strings.Replace(location, "http:", "https:", 1)
res.Header.Set("Location", location)
}
vendor/modules.txt
Vendored
+3 -3
View File
@@ -366,7 +366,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1
github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1
github.com/cs3org/go-cs3apis/cs3/tx/v1beta1
github.com/cs3org/go-cs3apis/cs3/types/v1beta1
# github.com/cs3org/reva/v2 v2.19.2-0.20240604132648-408bb6433068
# github.com/cs3org/reva/v2 v2.19.2-0.20240606075653-a7a1d2d2dace
## explicit; go 1.21
github.com/cs3org/reva/v2/cmd/revad/internal/grace
github.com/cs3org/reva/v2/cmd/revad/runtime
@@ -1882,7 +1882,7 @@ github.com/trustelem/zxcvbn/scoring
# github.com/tus/tusd v1.13.0
## explicit; go 1.16
github.com/tus/tusd/pkg/handler
# github.com/unrolled/secure v1.14.0 => github.com/DeepDiver1975/secure v0.0.0-20240424132259-5b29166734cb
# github.com/unrolled/secure v1.14.0 => github.com/DeepDiver1975/secure v0.0.0-20240611112133-abc838fb797c
## explicit; go 1.13
github.com/unrolled/secure
github.com/unrolled/secure/cspbuilder
@@ -2433,4 +2433,4 @@ stash.kopano.io/kgol/oidc-go
stash.kopano.io/kgol/rndm
# github.com/studio-b12/gowebdav => github.com/aduffeck/gowebdav v0.0.0-20231215102054-212d4a4374f6
# github.com/egirna/icap-client => github.com/fschade/icap-client v0.0.0-20240123094924-5af178158eaf
# github.com/unrolled/secure => github.com/DeepDiver1975/secure v0.0.0-20240424132259-5b29166734cb
# github.com/unrolled/secure => github.com/DeepDiver1975/secure v0.0.0-20240611112133-abc838fb797c