mirror of
https://github.com/discourse/discourse.git
synced 2025-05-01 11:24:32 +08:00
0d90f6e3c3
In some error paths, headers that were set earlier can get overwritten (e.g. `Cross-Origin-Opener-Policy`) by middleware such as ActionDispatch::ShowExceptions. This PR sets the `Cross-Origin-Opener-Policy` header to the value of the SiteSetting `cross_origin_opener_policy_header` if it's missing and if the response is for HTML. In future, this DefaultHeaders middleware can be used to set other default headers that relate to security or other purposes. ### Testing <img width="631" alt="test" src="https://github.com/user-attachments/assets/05106a40-2bc7-435d-91a2-4dd2a098f349" />
87 lines
2.9 KiB
Ruby
87 lines
2.9 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
# since all the rescue from clauses are not caught by the application controller for matches
|
|
# we need to handle certain exceptions here
|
|
module Middleware
|
|
class DiscoursePublicExceptions < ::ActionDispatch::PublicExceptions
|
|
require "middleware/default_headers"
|
|
# These middlewares will be re-run when the exception response is generated
|
|
EXCEPTION_RESPONSE_MIDDLEWARES = [
|
|
ContentSecurityPolicy::Middleware,
|
|
Middleware::CspScriptNonceInjector,
|
|
]
|
|
|
|
INVALID_REQUEST_ERRORS =
|
|
Set.new(
|
|
[
|
|
Rack::QueryParser::InvalidParameterError,
|
|
ActionController::BadRequest,
|
|
ActionDispatch::Http::Parameters::ParseError,
|
|
ActionController::RoutingError,
|
|
],
|
|
)
|
|
|
|
def call(env)
|
|
# this is so so gnarly
|
|
# sometimes we leak out exceptions prior to creating a controller instance
|
|
# this can happen if we have an exception in a route constraint in some cases
|
|
# this code re-dispatches the exception to our application controller so we can
|
|
# properly translate the exception to a page
|
|
exception = env["action_dispatch.exception"]
|
|
response = ActionDispatch::Response.new
|
|
|
|
exception = nil if INVALID_REQUEST_ERRORS.include?(exception)
|
|
|
|
if exception
|
|
begin
|
|
fake_controller = ApplicationController.new
|
|
fake_controller.set_response!(response)
|
|
fake_controller.request = request = ActionDispatch::Request.new(env)
|
|
|
|
# We can not re-dispatch bad mime types
|
|
begin
|
|
request.format
|
|
rescue Mime::Type::InvalidMimeType
|
|
return [
|
|
400,
|
|
{ "Cache-Control" => "private, max-age=0, must-revalidate" },
|
|
["Invalid MIME type"]
|
|
]
|
|
end
|
|
|
|
# Or badly formatted multipart requests
|
|
begin
|
|
request.POST
|
|
rescue ActionController::BadRequest => error
|
|
if error.cause.is_a?(EOFError)
|
|
return [
|
|
400,
|
|
{ "Cache-Control" => "private, max-age=0, must-revalidate" },
|
|
["Invalid request"]
|
|
]
|
|
else
|
|
raise
|
|
end
|
|
end
|
|
|
|
if ApplicationController.rescue_with_handler(exception, object: fake_controller)
|
|
body = response.body
|
|
body = [body] if String === body
|
|
rack_response = [response.status, response.headers, body]
|
|
app = lambda { |env| rack_response }
|
|
EXCEPTION_RESPONSE_MIDDLEWARES.each { |middleware| app = middleware.new(app) }
|
|
return app.call(env)
|
|
end
|
|
rescue => e
|
|
return super if INVALID_REQUEST_ERRORS.include?(e.class)
|
|
Discourse.warn_exception(
|
|
e,
|
|
message: "Failed to handle exception in exception app middleware",
|
|
)
|
|
end
|
|
end
|
|
super
|
|
end
|
|
end
|
|
end
|