Patch Rails 3修复CSRF保护漏洞

Question

我目前正在使用Rails 3.2的大项目，并且没有机会转移到Rails 4.据我所知，当您拥有JS视图时，Rails 3具有CSRF保护漏洞，这是由GET请求的。 在Rails 4中，它由此PR进行修复。

https://github.com/rails/rails/pull/13345/files

有谁知道我怎样才能修补Rails 3中修复此漏洞？

Answer 1

您可以将完全相同的更改应用于Rails 3.2 ActionController:: RequestForgeryProtection模块。

# config/initializers/cross_origin_script_tag_protection.rb 

module ActionController 
    class InvalidCrossOriginRequest < ActionControllerError 
    end 

    module RequestForgeryProtection 
    module ClassMethods 
     def protect_from_forgery(options = {}) 
     self.request_forgery_protection_token ||= :authenticity_token 
     prepend_before_filter :verify_authenticity_token, options 
     append_after_action :verify_same_origin_request 
     end 
    end 

    protected 

     def verify_authenticity_token 
     @marked_for_same_origin_verification = true 

     unless verified_request? 
      logger.warn "WARNING: Can't verify CSRF token authenticity" if logger 
      handle_unverified_request 
     end 
     end 

     CROSS_ORIGIN_JAVASCRIPT_WARNING = "Security warning: an embedded " \ 
     "<script> tag on another site requested protected JavaScript. " \ 
     "If you know what you're doing, go ahead and disable forgery " \ 
     "protection on this action to permit cross-origin JavaScript embedding." 
     private_constant :CROSS_ORIGIN_JAVASCRIPT_WARNING 

     # If `verify_authenticity_token` was run (indicating that we have 
     # forgery protection enabled for this request) then also verify that 
     # we aren't serving an unauthorized cross-origin response. 
     def verify_same_origin_request 
     if marked_for_same_origin_verification? && non_xhr_javascript_response? 
      logger.warn CROSS_ORIGIN_JAVASCRIPT_WARNING if logger 
      raise ActionController::InvalidCrossOriginRequest, CROSS_ORIGIN_JAVASCRIPT_WARNING 
     end 
     end 

     # If the `verify_authenticity_token` before_action ran, verify that 
     # JavaScript responses are only served to same-origin GET requests. 
     def marked_for_same_origin_verification? 
     defined? @marked_for_same_origin_verification 
     end 

     # Check for cross-origin JavaScript responses. 
     def non_xhr_javascript_response? 
     content_type =~ %r(\Atext/javascript) && !request.xhr? 
     end 
    end 
end 

请让我知道它是否适合您。