Fossil SCM

Write failed attempts to POST from a different origin into the error log. Add a new category to the error log filter for such messages.

drh 2025-03-17 13:16 trunk
Commit 2269ac697f5b06117c94de896f0b6adf852485fd463af7e08c37ec3fd6751319
Parent 3046c5e9609b5a8…
3 files changed +9 -2 +1 -1 +32 -26
~ src/cgi.c ~ src/main.c ~ src/security_audit.c
M src/cgi.c
+9 -2
--- src/cgi.c
+++ src/cgi.c
@@ -688,12 +688,16 @@
688688
 }
689689
690690
691691
 /*
692692
 ** Return true if the current request is coming from the same origin.
693
+**
694
+** If the request comes from a different origin and bErrorLog is true, then
695
+** put a warning message on the error log as this was a possible hack
696
+** attempt.
693697
 */
694
-int cgi_same_origin(void){
698
+int cgi_same_origin(int bErrorLog){
695699
 const char *zRef;
696700
 char *zToFree = 0;
697701
 int nBase;
698702
 int rc;
699703
 if( g.zBaseURL==0 ) return 0;
@@ -710,10 +714,13 @@
710714
 }else if( zRef[nBase]!=0 && zRef[nBase]!='/' ){
711715
 rc = 0;
712716
 }else{
713717
 rc = 1;
714718
 }
719
+ if( rc==0 && bErrorLog ){
720
+ fossil_errorlog("warning: POST from different origin");
721
+ }
715722
 fossil_free(zToFree);
716723
 return rc;
717724
 }
718725
719726
 /*
@@ -746,11 +753,11 @@
746753
 ** 3: (2) plus there is a valid "csrf" token in the request
747754
 */
748755
 int cgi_csrf_safe(int securityLevel){
749756
 if( g.okCsrf<0 ) return 0;
750757
 if( g.okCsrf==0 ){
751
- if( !cgi_same_origin() ){
758
+ if( !cgi_same_origin(1) ){
752759
 g.okCsrf = -1;
753760
 }else{
754761
 g.okCsrf = 1;
755762
 if( cgi_is_post_request() ){
756763
 g.okCsrf = 2;
757764
--- src/cgi.c
+++ src/cgi.c
@@ -688,12 +688,16 @@
688 }
689
690
691 /*
692 ** Return true if the current request is coming from the same origin.
 
 
 
 
693 */
694 int cgi_same_origin(void){
695 const char *zRef;
696 char *zToFree = 0;
697 int nBase;
698 int rc;
699 if( g.zBaseURL==0 ) return 0;
@@ -710,10 +714,13 @@
710 }else if( zRef[nBase]!=0 && zRef[nBase]!='/' ){
711 rc = 0;
712 }else{
713 rc = 1;
714 }
 
 
 
715 fossil_free(zToFree);
716 return rc;
717 }
718
719 /*
@@ -746,11 +753,11 @@
746 ** 3: (2) plus there is a valid "csrf" token in the request
747 */
748 int cgi_csrf_safe(int securityLevel){
749 if( g.okCsrf<0 ) return 0;
750 if( g.okCsrf==0 ){
751 if( !cgi_same_origin() ){
752 g.okCsrf = -1;
753 }else{
754 g.okCsrf = 1;
755 if( cgi_is_post_request() ){
756 g.okCsrf = 2;
757
--- src/cgi.c
+++ src/cgi.c
@@ -688,12 +688,16 @@
688 }
689
690
691 /*
692 ** Return true if the current request is coming from the same origin.
693 **
694 ** If the request comes from a different origin and bErrorLog is true, then
695 ** put a warning message on the error log as this was a possible hack
696 ** attempt.
697 */
698 int cgi_same_origin(int bErrorLog){
699 const char *zRef;
700 char *zToFree = 0;
701 int nBase;
702 int rc;
703 if( g.zBaseURL==0 ) return 0;
@@ -710,10 +714,13 @@
714 }else if( zRef[nBase]!=0 && zRef[nBase]!='/' ){
715 rc = 0;
716 }else{
717 rc = 1;
718 }
719 if( rc==0 && bErrorLog ){
720 fossil_errorlog("warning: POST from different origin");
721 }
722 fossil_free(zToFree);
723 return rc;
724 }
725
726 /*
@@ -746,11 +753,11 @@
753 ** 3: (2) plus there is a valid "csrf" token in the request
754 */
755 int cgi_csrf_safe(int securityLevel){
756 if( g.okCsrf<0 ) return 0;
757 if( g.okCsrf==0 ){
758 if( !cgi_same_origin(1) ){
759 g.okCsrf = -1;
760 }else{
761 g.okCsrf = 1;
762 if( cgi_is_post_request() ){
763 g.okCsrf = 2;
764
M src/main.c
+1 -1
--- src/main.c
+++ src/main.c
@@ -2161,11 +2161,11 @@
21612161
 }
21622162
 }
21632163
 #endif
21642164
 if( (pCmd->eCmdFlags & CMDFLAG_RAWCONTENT)==0 ){
21652165
 cgi_decode_post_parameters();
2166
- if( !cgi_same_origin() ){
2166
+ if( !cgi_same_origin(0) ){
21672167
 isReadonly = 1;
21682168
 db_protect(PROTECT_READONLY);
21692169
 }
21702170
 }
21712171
 if( g.fCgiTrace ){
21722172
--- src/main.c
+++ src/main.c
@@ -2161,11 +2161,11 @@
2161 }
2162 }
2163 #endif
2164 if( (pCmd->eCmdFlags & CMDFLAG_RAWCONTENT)==0 ){
2165 cgi_decode_post_parameters();
2166 if( !cgi_same_origin() ){
2167 isReadonly = 1;
2168 db_protect(PROTECT_READONLY);
2169 }
2170 }
2171 if( g.fCgiTrace ){
2172
--- src/main.c
+++ src/main.c
@@ -2161,11 +2161,11 @@
2161 }
2162 }
2163 #endif
2164 if( (pCmd->eCmdFlags & CMDFLAG_RAWCONTENT)==0 ){
2165 cgi_decode_post_parameters();
2166 if( !cgi_same_origin(0) ){
2167 isReadonly = 1;
2168 db_protect(PROTECT_READONLY);
2169 }
2170 }
2171 if( g.fCgiTrace ){
2172
M src/security_audit.c
+32 -26
--- src/security_audit.c
+++ src/security_audit.c
@@ -813,10 +813,11 @@
813813
 ** this page.
814814
 **
815815
 ** y=0x01 Show only hack attempts
816816
 ** y=0x02 Show only panics and assertion faults
817817
 ** y=0x04 Show hung backoffice processes
818
+** y=0x08 Show POST requests from a different origin
818819
 ** y=0x40 Show other uncategorized messages
819820
 **
820821
 ** If y is omitted or is zero, a count of the various message types is
821822
 ** shown.
822823
 */
@@ -823,18 +824,19 @@
823824
 void errorlog_page(void){
824825
 i64 szFile;
825826
 FILE *in;
826827
 char *zLog;
827828
 const char *zType = P("y");
828
- static const int eAllTypes = 0x47;
829
+ static const int eAllTypes = 0x4f;
829830
 long eType = 0;
830831
 int bOutput = 0;
831832
 int prevWasTime = 0;
832833
 int nHack = 0;
833834
 int nPanic = 0;
834835
 int nOther = 0;
835836
 int nHang = 0;
837
+ int nXPost = 0;
836838
 char z[10000];
837839
 char zTime[10000];
838840
839841
 login_check_credentials();
840842
 if( !g.perm.Admin ){
@@ -901,10 +903,13 @@
901903
 @ <li>Panics and assertion faults
902904
 }
903905
 if( eType & 0x04 ){
904906
 @ <li>Hung backoffice processes
905907
 }
908
+ if( eType & 0x08 ){
909
+ @ <li>POST requests from different origin
910
+ }
906911
 if( eType & 0x40 ){
907912
 @ <li>Other uncategorized messages
908913
 }
909914
 @ </ul>
910915
 }
@@ -923,11 +928,16 @@
923928
 nPanic++;
924929
 }else
925930
 if( sqlite3_strglob("warning: backoffice process * still *",z)==0 ){
926931
 bOutput = (eType & 0x04)!=0;
927932
 nHang++;
928
- }else{
933
+ }else
934
+ if( sqlite3_strglob("warning: POST from different origin*",z)==0 ){
935
+ bOutput = (eType & 0x08)!=0;
936
+ nXPost++;
937
+ }else
938
+ {
929939
 bOutput = (eType & 0x40)!=0;
930940
 nOther++;
931941
 }
932942
 if( bOutput ){
933943
 @ %h(zTime)\
@@ -948,40 +958,36 @@
948958
 fclose(in);
949959
 if( eType ){
950960
 @ </pre>
951961
 }
952962
 if( eType==0 ){
953
- int nNonHack = nPanic+nHang+nOther;
954
- int nTotal = nNonHack + nHack;
963
+ int nNonHack = nPanic + nHang + nOther;
964
+ int nTotal = nNonHack + nHack + nXPost;
955965
 @ <p><table border="a" cellspacing="0" cellpadding="5">
956
- @ <tr><td align="right">%d(nPanic)</td>
957966
 if( nPanic>0 ){
967
+ @ <tr><td align="right">%d(nPanic)</td>
958968
 @ <td><a href="./errorlog?y=2">Panics</a></td>
959
- } else {
960
- @ <td>Panics</td>
961969
 }
962
- @ <tr><td align="right">%d(nHack)</td>
963970
 if( nHack>0 ){
971
+ @ <tr><td align="right">%d(nHack)</td>
964972
 @ <td><a href="./errorlog?y=1">Hack Attempts</a></td>
965
- if( nNonHack ){
966
- @ <tr><td align="right">%d(nNonHack)</td>
967
- @ <td><a href="%R/errorlog?y=70">Other than hack attempts</a></td>
968
- }
969
- }else{
970
- @ <td>Hack Attempts</td>
971
- }
972
- @ <tr><td align="right">%d(nHang)</td>
973
- if( nHang>0 ){
974
- @ <td><a href="./errorlog?y=4/">Hung Backoffice</a></td>
975
- }else{
976
- @ <td>Hung Backoffice</td>
977
- }
978
- @ <tr><td align="right">%d(nHang)</td>
979
- if( nOther>0 ){
980
- @ <td><a href="./errorlog?y=64/">Other</a></td>
981
- }else{
982
- @ <td>Other</td>
973
+ }
974
+ if( nHang>0 ){
975
+ @ <tr><td align="right">%d(nHang)</td>
976
+ @ <td><a href="./errorlog?y=4/">Hung Backoffice</a></td>
977
+ }
978
+ if( nXPost>0 ){
979
+ @ <tr><td align="right">%d(nXPost)</td>
980
+ @ <td><a href="./errorlog?y=8/">POSTs from different origin</a></td>
981
+ }
982
+ if( nOther>0 ){
983
+ @ <tr><td align="right">%d(nOther)</td>
984
+ @ <td><a href="./errorlog?y=64/">Other</a></td>
985
+ }
986
+ if( nHack+nXPost>0 && nNonHack>0 ){
987
+ @ <tr><td align="right">%d(nNonHack)</td>
988
+ @ <td><a href="%R/errorlog?y=70">Other than hack attempts</a></td>
983989
 }
984990
 @ <tr><td align="right">%d(nTotal)</td>
985991
 if( nTotal>0 ){
986992
 @ <td><a href="./errorlog">All Messages</a></td>
987993
 }else{
988994
--- src/security_audit.c
+++ src/security_audit.c
@@ -813,10 +813,11 @@
813 ** this page.
814 **
815 ** y=0x01 Show only hack attempts
816 ** y=0x02 Show only panics and assertion faults
817 ** y=0x04 Show hung backoffice processes
 
818 ** y=0x40 Show other uncategorized messages
819 **
820 ** If y is omitted or is zero, a count of the various message types is
821 ** shown.
822 */
@@ -823,18 +824,19 @@
823 void errorlog_page(void){
824 i64 szFile;
825 FILE *in;
826 char *zLog;
827 const char *zType = P("y");
828 static const int eAllTypes = 0x47;
829 long eType = 0;
830 int bOutput = 0;
831 int prevWasTime = 0;
832 int nHack = 0;
833 int nPanic = 0;
834 int nOther = 0;
835 int nHang = 0;
 
836 char z[10000];
837 char zTime[10000];
838
839 login_check_credentials();
840 if( !g.perm.Admin ){
@@ -901,10 +903,13 @@
901 @ <li>Panics and assertion faults
902 }
903 if( eType & 0x04 ){
904 @ <li>Hung backoffice processes
905 }
 
 
 
906 if( eType & 0x40 ){
907 @ <li>Other uncategorized messages
908 }
909 @ </ul>
910 }
@@ -923,11 +928,16 @@
923 nPanic++;
924 }else
925 if( sqlite3_strglob("warning: backoffice process * still *",z)==0 ){
926 bOutput = (eType & 0x04)!=0;
927 nHang++;
928 }else{
 
 
 
 
 
929 bOutput = (eType & 0x40)!=0;
930 nOther++;
931 }
932 if( bOutput ){
933 @ %h(zTime)\
@@ -948,40 +958,36 @@
948 fclose(in);
949 if( eType ){
950 @ </pre>
951 }
952 if( eType==0 ){
953 int nNonHack = nPanic+nHang+nOther;
954 int nTotal = nNonHack + nHack;
955 @ <p><table border="a" cellspacing="0" cellpadding="5">
956 @ <tr><td align="right">%d(nPanic)</td>
957 if( nPanic>0 ){
 
958 @ <td><a href="./errorlog?y=2">Panics</a></td>
959 } else {
960 @ <td>Panics</td>
961 }
962 @ <tr><td align="right">%d(nHack)</td>
963 if( nHack>0 ){
 
964 @ <td><a href="./errorlog?y=1">Hack Attempts</a></td>
965 if( nNonHack ){
966 @ <tr><td align="right">%d(nNonHack)</td>
967 @ <td><a href="%R/errorlog?y=70">Other than hack attempts</a></td>
968 }
969 }else{
970 @ <td>Hack Attempts</td>
971 }
972 @ <tr><td align="right">%d(nHang)</td>
973 if( nHang>0 ){
974 @ <td><a href="./errorlog?y=4/">Hung Backoffice</a></td>
975 }else{
976 @ <td>Hung Backoffice</td>
977 }
978 @ <tr><td align="right">%d(nHang)</td>
979 if( nOther>0 ){
980 @ <td><a href="./errorlog?y=64/">Other</a></td>
981 }else{
982 @ <td>Other</td>
983 }
984 @ <tr><td align="right">%d(nTotal)</td>
985 if( nTotal>0 ){
986 @ <td><a href="./errorlog">All Messages</a></td>
987 }else{
988
--- src/security_audit.c
+++ src/security_audit.c
@@ -813,10 +813,11 @@
813 ** this page.
814 **
815 ** y=0x01 Show only hack attempts
816 ** y=0x02 Show only panics and assertion faults
817 ** y=0x04 Show hung backoffice processes
818 ** y=0x08 Show POST requests from a different origin
819 ** y=0x40 Show other uncategorized messages
820 **
821 ** If y is omitted or is zero, a count of the various message types is
822 ** shown.
823 */
@@ -823,18 +824,19 @@
824 void errorlog_page(void){
825 i64 szFile;
826 FILE *in;
827 char *zLog;
828 const char *zType = P("y");
829 static const int eAllTypes = 0x4f;
830 long eType = 0;
831 int bOutput = 0;
832 int prevWasTime = 0;
833 int nHack = 0;
834 int nPanic = 0;
835 int nOther = 0;
836 int nHang = 0;
837 int nXPost = 0;
838 char z[10000];
839 char zTime[10000];
840
841 login_check_credentials();
842 if( !g.perm.Admin ){
@@ -901,10 +903,13 @@
903 @ <li>Panics and assertion faults
904 }
905 if( eType & 0x04 ){
906 @ <li>Hung backoffice processes
907 }
908 if( eType & 0x08 ){
909 @ <li>POST requests from different origin
910 }
911 if( eType & 0x40 ){
912 @ <li>Other uncategorized messages
913 }
914 @ </ul>
915 }
@@ -923,11 +928,16 @@
928 nPanic++;
929 }else
930 if( sqlite3_strglob("warning: backoffice process * still *",z)==0 ){
931 bOutput = (eType & 0x04)!=0;
932 nHang++;
933 }else
934 if( sqlite3_strglob("warning: POST from different origin*",z)==0 ){
935 bOutput = (eType & 0x08)!=0;
936 nXPost++;
937 }else
938 {
939 bOutput = (eType & 0x40)!=0;
940 nOther++;
941 }
942 if( bOutput ){
943 @ %h(zTime)\
@@ -948,40 +958,36 @@
958 fclose(in);
959 if( eType ){
960 @ </pre>
961 }
962 if( eType==0 ){
963 int nNonHack = nPanic + nHang + nOther;
964 int nTotal = nNonHack + nHack + nXPost;
965 @ <p><table border="a" cellspacing="0" cellpadding="5">
 
966 if( nPanic>0 ){
967 @ <tr><td align="right">%d(nPanic)</td>
968 @ <td><a href="./errorlog?y=2">Panics</a></td>
 
 
969 }
 
970 if( nHack>0 ){
971 @ <tr><td align="right">%d(nHack)</td>
972 @ <td><a href="./errorlog?y=1">Hack Attempts</a></td>
973 }
974 if( nHang>0 ){
975 @ <tr><td align="right">%d(nHang)</td>
976 @ <td><a href="./errorlog?y=4/">Hung Backoffice</a></td>
977 }
978 if( nXPost>0 ){
979 @ <tr><td align="right">%d(nXPost)</td>
980 @ <td><a href="./errorlog?y=8/">POSTs from different origin</a></td>
981 }
982 if( nOther>0 ){
983 @ <tr><td align="right">%d(nOther)</td>
984 @ <td><a href="./errorlog?y=64/">Other</a></td>
985 }
986 if( nHack+nXPost>0 && nNonHack>0 ){
987 @ <tr><td align="right">%d(nNonHack)</td>
988 @ <td><a href="%R/errorlog?y=70">Other than hack attempts</a></td>
 
 
989 }
990 @ <tr><td align="right">%d(nTotal)</td>
991 if( nTotal>0 ){
992 @ <td><a href="./errorlog">All Messages</a></td>
993 }else{
994

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button