Subject: [pgAdmin][5919] Fix security related issues

From: Ganesh Jaybhay <[email-masked]>
Date: Mon, 19 Oct 2020 17:31:07 +0530

Hi Hackers,

Please find the attached patch to fix the below security issues:

   - Host Header Injection - Added ALLOWED_HOSTS list to limit host address
   - Lack of Content Security Policy (CSP) - Added security header
   - Lack of Protection Mechanisms - HSTS - Added security header
   - Lack of Cookie Attribute – Secure : Kept as False as secure limits
   cookies to HTTPS traffic only.
   - Information Disclosure – Web Server / Development Framework
   VersionDescription: Kept as hard coded 'Python' instead of exposing
   wsgi/python/gunicorn version info.

Please review and let me know if I have missed anything.

Regards,
Ganesh Jaybhay

---

From: Dave Page <[email-masked]>
Date: Mon, 19 Oct 2020 13:08:03 +0100

Hi

> Please review and let me know if I have missed anything.

I took a very quick look at this, and one thing that immediately stood out
is that HSTS should definitely not be enabled by default. That can make
dev/test/redeploy extremely difficult.

-- 
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

EDB: http://www.enterprisedb.com

---

From: Ganesh Jaybhay <[email-masked]>
Date: Mon, 19 Oct 2020 19:16:58 +0530

Thank you Dave for the suggestion.

Please find the attached updated patch to make HSTS by default disabled and
conditional based on flag.

Regards,
Ganesh Jaybhay

---

From: Akshay Joshi <[email-masked]>
Date: Tue, 20 Oct 2020 17:17:26 +0530

Thanks, patch applied.

On Mon, Oct 19, 2020 at 7:17 PM Ganesh Jaybhay <
[email-masked]> wrote:

> Please find the attached updated patch to make HSTS by default disabled
> and conditional based on flag.
>
> Regards,
> Ganesh Jaybhay
>
>> I took a very quick look at this, and one thing that immediately stood
>> out is that HSTS should definitely not be enabled by default. That can make

-- 
*Thanks & Regards*
*Akshay Joshi*
*pgAdmin Hacker | Sr. Software Architect*
*EDB Postgres <http://edbpostgres.com>*

*Mobile: +91 976-788-8246*