1. 13 Apr, 2016 1 commit
  2. 12 Apr, 2016 8 commits
  3. 11 Apr, 2016 3 commits
  4. 08 Apr, 2016 14 commits
  5. 07 Apr, 2016 11 commits
  6. 05 Apr, 2016 1 commit
  7. 04 Apr, 2016 2 commits
    • Jeromy Johnson's avatar
      Merge pull request #1988 from ipfs/ipfs-prefix-hardening · c6e6bb05
      Jeromy Johnson authored
      gateway: harden path prefix
      c6e6bb05
    • Lars Gierth's avatar
      gateway: enforce allowlist for path prefixes · 09937f84
      Lars Gierth authored
      The gateway accepts an X-Ipfs-Path-Prefix header,
      and assumes that it is mounted in a reverse proxy
      like nginx, at this path. Links in directory listings,
      as well as trailing-slash redirects need to be rewritten
      with that prefix in mind.
      
      We don't want a potential attacker to be able to
      pass in arbitrary path prefixes, which would end up
      in redirects and directory listings, which is why
      every prefix has to be explicitly allowed in the config.
      
      Previously, we'd accept *any* X-Ipfs-Path-Prefix header.
      
      Example:
      
      We mount blog.ipfs.io (a dnslink page) at ipfs.io/blog.
      
      nginx_ipfs.conf:
      
          location /blog/ {
              rewrite "^/blog(/.*)$" $1 break;
              proxy_set_header Host blog.ipfs.io;
              proxy_set_header X-Ipfs-Gateway-Prefix /blog;
              proxy_pass http://127.0.0.1:8080;
          }
      
      .ipfs/config:
      
          "Gateway": {
              "PathPrefixes": ["/blog"],
              // ...
          },
      
      dnslink:
      
          > dig TXT _dnslink.blog.ipfs.io
          dnslink=/ipfs/QmWcBjXPAEdhXDATV4ghUpkAonNBbiyFx1VmmHcQe9HEGd
      
      License: MIT
      Signed-off-by: default avatarLars Gierth <larsg@systemli.org>
      09937f84