Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kUq7a-0001cb-Fs for pgadmin-hackers@arkaria.postgresql.org; Tue, 20 Oct 2020 11:48:06 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kUq7Z-0001mY-DB for pgadmin-hackers@arkaria.postgresql.org; Tue, 20 Oct 2020 11:48:05 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kUq7Z-0001kr-6z for pgadmin-hackers@lists.postgresql.org; Tue, 20 Oct 2020 11:48:05 +0000 Received: from mail-io1-xd41.google.com ([2607:f8b0:4864:20::d41]) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1kUq79-0000ix-7n for pgadmin-hackers@postgresql.org; Tue, 20 Oct 2020 11:47:41 +0000 Received: by mail-io1-xd41.google.com with SMTP id q25so2731732ioh.4 for ; Tue, 20 Oct 2020 04:47:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=enterprisedb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/pt4lSyVar2OCV8kjPo0l1E20P7aY1upRDy8mcWrklc=; b=TCsxgiNovfYnIQUbmkOjh8iMpHhWogbQaO88wp8QURDpCGuan5V4g+X74lXdRAzg18 nd1blWqGUH83pcHQH6XUIwU+lveJqZrTkAVuL0f2Z46vIUQ4y6gNyNaOrBCJihbjzYHk 0rFOKjAa8XX2B5xqOraxX8p9l2DvJcRorJCDsbwsrz2bJf2xE8LUfOK5K5dlg9+V7Q5Z h1mteBbsSlUtMFGFAHuKV79m5/2ZRbHc8mvf6Zou8052CMYMMH8rdE78++lUNk7QJCPE CMIiKHHw4FxCJdbzGaJvZUpO4eIMVW6u/v6Be8SOuP5dmtD4wp2KgMEMHg5JKK3ZRkj6 wTig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/pt4lSyVar2OCV8kjPo0l1E20P7aY1upRDy8mcWrklc=; b=j4oTD/ZqMy/+xNjaqxAiHRg2XbSGU6iI3uwLNJyUbY05gyQtOAWXA+Nww1S5+kjKhb cp2PcpsLGpE3l+lN5n9YgucmlZTxpiQhpyZgcm1oMVCyQbCWRsl5acbrvpwcOwkpvW2p 8lv2pBEmCTdjdh+EDE8Fmj/nCQJtm3qdygeIkqADzaw6VBb3I8Q1Dtm1BU49rbH3tuZ7 cO+GruIvuUVynG9/DKA/vL+X6yaSSOJLPdLjN1OsfwjLpeaqWjQdsItEV3Ld1Uwd8u4C m6zJJ57vV/goE3KMUMuXpda4V3CRGZr1PZjPto34Nn2yypuRq0DZ7asWgMqOpEwRSRfh 73oQ== X-Gm-Message-State: AOAM530H7sWia8ozDYb9ruKaRnnl4ZKMPPo+zqiPcVJiSIPZHlqJqe90 tugCo0U0zWBk5SaCOGGMluEsPy4RwS/dZtqu1YwuX9Q9JLqHWtkglIojrcWcRfSXqMF2l/lt0wl M/QL1Am2ETObqNbt2b/Ur2BmI7JBKB6hFNyTZdXdzfPL0O1Uc5FESZQ9NzkPeTerg38D/pNKmN9 vYpg46v8wASRU9NENiF56DCsPsAxs2SZ9+mCTaq8poplqFMoJI4mU40BijbQ== X-Google-Smtp-Source: ABdhPJxdRt1v2Br/4RUYjCDRaGo00yYkmzqNqHnJr/tcoue4Uqbl3QunmQCXy9r4AkxT4RAI2tqEnvSKihVdgRQEaUk= X-Received: by 2002:a05:6638:606:: with SMTP id g6mr1693520jar.0.1603194457372; Tue, 20 Oct 2020 04:47:37 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Akshay Joshi Date: Tue, 20 Oct 2020 17:17:26 +0530 Message-ID: Subject: Re: [pgAdmin][5919] Fix security related issues To: Ganesh Jaybhay Cc: Dave Page , pgadmin-hackers Content-Type: multipart/alternative; boundary="000000000000236acb05b218ccc1" X-CLOUD-SEC-AV-Info: enterprisedb,google_mail,monitor X-CLOUD-SEC-AV-Sent: true X-Gm-Spam: 0 X-Gm-Phishy: 0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --000000000000236acb05b218ccc1 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks, patch applied. On Mon, Oct 19, 2020 at 7:17 PM Ganesh Jaybhay < ganesh.jaybhay@enterprisedb.com> wrote: > Thank you Dave for the suggestion. > > Please find the attached updated patch to make HSTS by default disabled > and conditional based on flag. > > Regards, > Ganesh Jaybhay > > On Mon, Oct 19, 2020 at 5:38 PM Dave Page wrote: > >> Hi >> >> On Mon, Oct 19, 2020 at 1:01 PM Ganesh Jaybhay < >> ganesh.jaybhay@enterprisedb.com> wrote: >> >>> Hi Hackers, >>> >>> Please find the attached patch to fix the below security issues: >>> >>> - Host Header Injection - Added ALLOWED_HOSTS list to limit host >>> address >>> - Lack of Content Security Policy (CSP) - Added security header >>> - Lack of Protection Mechanisms - HSTS - Added security header >>> - Lack of Cookie Attribute =E2=80=93 Secure : Kept as False as secur= e limits >>> cookies to HTTPS traffic only. >>> - Information Disclosure =E2=80=93 Web Server / Development Framewor= k >>> VersionDescription: Kept as hard coded 'Python' instead of exposing >>> wsgi/python/gunicorn version info. >>> >>> Please review and let me know if I have missed anything. >>> >> >> I took a very quick look at this, and one thing that immediately stood >> out is that HSTS should definitely not be enabled by default. That can m= ake >> dev/test/redeploy extremely difficult. >> >> -- >> Dave Page >> Blog: http://pgsnake.blogspot.com >> Twitter: @pgsnake >> >> EDB: http://www.enterprisedb.com >> >> --=20 *Thanks & Regards* *Akshay Joshi* *pgAdmin Hacker | Sr. Software Architect* *EDB Postgres * *Mobile: +91 976-788-8246* --000000000000236acb05b218ccc1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks, patch applied.

On Mon, Oct 19, 2020 at 7:17 PM Gane= sh Jaybhay <ganesh.ja= ybhay@enterprisedb.com> wrote:
Thank you Dave for the suggestion.
Please find the attached updated patch to make HSTS by de= fault disabled and conditional based on flag.

Rega= rds,
Ganesh=C2=A0Jaybhay

On Mon, Oct 19, 2020 at 5:38 PM Dav= e Page <dpage@pga= dmin.org> wrote:
Hi

On Mon, Oct 19, 2020 at 1:01 PM Ganesh Jayb= hay <ganesh.jaybhay@enterprisedb.com> wrote:
Hi Hackers,

Please find the attached patch to fix the below security issues:
  • Host Header Injection -=C2=A0Added ALLOWED_HOSTS list to limi= t host address=C2=A0
  • Lack of Content Security Policy (CSP) - Added = security header
  • Lack of Protection Mechanisms - HSTS -=C2=A0Added s= ecurity header
  • Lack of Cookie Attribute =E2=80=93 Secure : Kept as = False as secure limits cookies to HTTPS traffic only.
  • Information D= isclosure =E2=80=93 Web Server / Development Framework VersionDescription: = Kept=C2=A0as hard coded 'Python' instead of exposing wsgi/python/gu= nicorn version info.
Please review and let me know if I have = missed anything.

I took a= very quick look at this, and one thing that immediately stood out is that = HSTS should definitely not be enabled by default. That can make dev/test/re= deploy extremely difficult.
=C2=A0
--
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnak= e

EDB: htt= p://www.enterprisedb.com



--
Thanks & Regards
Akshay Joshi
pgAdmi= n Hacker | Sr. Software Architect
EDB Postgres
Mobile: +91 976-788-8246
=
--000000000000236acb05b218ccc1--