mitigate CVE-2015-9284

sashazykov · sashazykov · commit b3e17b5b6ca6 · 2020-11-27T10:28:30.000+01:00
diff --git a/Gemfile b/Gemfile
@@ -31,6 +31,7 @@ gem 'mysql2', group: :production
 gem 'octokit'
 gem 'omniauth'
 gem 'omniauth-github'
+gem 'omniauth-rails_csrf_protection', '~> 0.1'
 gem 'rails-i18n'
 gem 'render_csv'
 gem 'rest-client'
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -258,6 +258,9 @@ GEM
     omniauth-oauth2 (1.7.0)
       oauth2 (~> 1.4)
       omniauth (~> 1.9)
+    omniauth-rails_csrf_protection (0.1.2)
+      actionpack (>= 4.2)
+      omniauth (>= 1.3.1)
     orm_adapter (0.5.0)
     parallel (1.20.0)
     parser (2.7.2.0)
@@ -464,6 +467,7 @@ DEPENDENCIES
   octokit
   omniauth
   omniauth-github
+  omniauth-rails_csrf_protection (~> 0.1)
   rails (= 5.2.4.4)
   rails-controller-testing
   rails-i18n
diff --git a/app/views/devise/shared/_links.haml b/app/views/devise/shared/_links.haml
@@ -15,5 +15,5 @@
   %br/
 - if devise_mapping.omniauthable?
   - resource_class.omniauth_providers.each do |provider|
-    = link_to t('devise.links.sign_in_with', provider: provider.to_s.titleize), omniauth_authorize_path(resource_name, provider)
+    = link_to t('devise.links.sign_in_with', provider: provider.to_s.titleize), omniauth_authorize_path(resource_name, provider), method: :post
     %br/
diff --git a/spec/requests/cve_2005_9284_regression_spec.rb b/spec/requests/cve_2005_9284_regression_spec.rb
@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+# Make sure that https://nvd.nist.gov/vuln/detail/CVE-2015-9284 is mitigated
+describe 'CVE-2015-9284', type: :request do
+  describe 'GET /auth/:provider' do
+    it do
+      get '/users/auth/github'
+      expect(response).not_to have_http_status(:redirect)
+    end
+  end
+
+  describe 'POST /auth/:provider without CSRF token' do
+    before do
+      @allow_forgery_protection = ActionController::Base.allow_forgery_protection
+      ActionController::Base.allow_forgery_protection = true
+    end
+
+    it do
+      expect do
+        post '/users/auth/github'
+      end.to raise_error(ActionController::InvalidAuthenticityToken)
+    end
+
+    after do
+      ActionController::Base.allow_forgery_protection = @allow_forgery_protection
+    end
+  end
+end
