[Security Issue] Avoid Exposing Ports without Authentication #5442
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
`proxy` should `await` for result of `authenticated` call to avoid security issues.
code-asher
approved these changes
Aug 10, 2022
There was a problem hiding this comment.
Thank you!! This is definitely a big deal. @jsjoeio we should probably try releasing soon with this fix.
|
Big thank you for finding and fixing @rafaelcalpena!
Agreed! |
Codecov Report
@@ Coverage Diff @@
## main #5442 +/- ##
=======================================
Coverage 72.44% 72.44%
=======================================
Files 30 30
Lines 1673 1673
Branches 366 366
=======================================
Hits 1212 1212
Misses 398 398
Partials 63 63
Continue to review full report at Codecov.
|
|
Thanks @code-asher and @jsjoeio for merging and releasing this! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi, I have recently started using
code-serverand the proxy feature is very handy, however I realized that anyone can access proxied ports on public domains. Theauthenticatedcall seems to be working correctly, but the proxy function does not wait asynchronously for the authentication result.I believe this is a high-priority issue with consequences such as disclosure of unwanted data and potential priviledge escalation on the system. I have not tested my fix, but only minor changes were necessary, so it should be ready to go.