bubblev
/
bubble
9
0
Fork 0
Code Issues 0 Pull Requests 0 Releases 130 Wiki Activity
Labels Milestones
New Pull Request

#58 Add request protector app with cross-domain cookies filtering

Merged
jonathan merged 35 commits from kris/request_protector_app into master 4 years ago
Conversation 4 Commits 35 Files Changed 17
kris commented 4 years ago

@jonathan please review

Waiting on Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/252/
but not sure how it will go as current master build is failing.

@jonathan please review Waiting on Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/252/ but not sure how it will go as current master build is failing.
jonathan was assigned by kris 4 years ago
jonathan commented 4 years ago
Owner

Looks good, but what would the regex be if the intent is “delete any cookies NOT belonging to the current domain, or one of its subdomains”?

It seems like we would need some more logic -- if we add these 2 things I think it would work:

  1. The regex can include {{fqdn}} which will be replaced (in mitm-land) with the (regex-escaped) FQDN for the current request
  2. In addition to regex and replacement, add mode which can be match or no_match. Or, alternatively, see if the “regex negation” syntax works in Python’s regex implementation, see: https://stackoverflow.com/questions/2637675/how-to-negate-the-whole-regex ). If regex negation works, that may be easier.

Thoughts?

Looks good, but what would the regex be if the intent is "delete any cookies NOT belonging to the current domain, or one of its subdomains"? It seems like we would need some more logic -- if we add these 2 things I think it would work: 1. The regex can include `{{fqdn}}` which will be replaced (in mitm-land) with the (regex-escaped) FQDN for the current request 2. In addition to `regex` and `replacement`, add `mode` which can be `match` or `no_match`. Or, alternatively, see if the "regex negation" syntax works in Python's regex implementation, see: https://stackoverflow.com/questions/2637675/how-to-negate-the-whole-regex ). If regex negation works, that may be easier. Thoughts?
kris commented 4 years ago
Poster
  1. will do. Separate PR? (easier review)
  2. (?!...) is supported in python3’s re
1. will do. Separate PR? (easier review) 2. `(?!...)` is supported in python3's `re`
jonathan commented 4 years ago
Owner
  1. will do. Separate PR? (easier review)

No, let’s do it in this one. And test it :) this will be very cool when it works!

  1. (?!...) is supported in python3’s re

That’s good news. Let’s do that.

> 1. will do. Separate PR? (easier review) No, let's do it in this one. And test it :) this will be very cool when it works! > 2. `(?!...)` is supported in python3's `re` That's good news. Let's do that.
👍 1
kris changed title from Add request protector app with cross-domain cookies filtering to WIP: (testing after fqdn part) Add request protector app with cross-domain cookies filtering 4 years ago
kris changed title from WIP: (testing after fqdn part) Add request protector app with cross-domain cookies filtering to Add request protector app with cross-domain cookies filtering 4 years ago
kris changed title from Add request protector app with cross-domain cookies filtering to WIP: (waiting on fresh Jenkins build) Add request protector app with cross-domain cookies filtering 4 years ago
kris changed title from WIP: (waiting on fresh Jenkins build) Add request protector app with cross-domain cookies filtering to Add request protector app with cross-domain cookies filtering 4 years ago
kris commented 4 years ago
Poster

Passing Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/260/

Passing Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/260/
jonathan requested changes 4 years ago
jonathan left a comment

minor changes requested.

bubble-server/src/main/resources/models/defaults/bubblePlan.json
@@ -38,2 +38,3 @@
{"app": "UserBlocker"},
{"app": "TlsPassthru"}
{"app": "TlsPassthru"},
{"app": "RequestProtector"}
jonathan commented 4 years ago

Let’s add RequestProtector app to all plans.

Let's add `RequestProtector` app to all plans.
bubble-server/src/main/resources/packer/roles/mitmproxy/files/bubble_api.py
@@ -452,0 +487,4 @@

def _replace_in_headers(headers: nheaders.Headers, modifiers_dict: dict) -> int:
"""
Taken from original mitmproxy's Header class implementation with sligh change to allow replacement with empty string
jonathan commented 4 years ago

r/sligh/slight/

`r/sligh/slight/`
kris commented 4 years ago

Actully, I’ll remove this second part completely as I did a larger changes here recently

Actully, I'll remove this second part completely as I did a larger changes here recently
jonathan referenced this issue from a commit 4 years ago
Add request protector app with cross-domain cookies filtering (#58) Add RequestProtector app to cheapest plan Update comment with typo Merge branch 'master' into kris/request_protector_app Merge branch 'master' into kris/request_protector_app Merge branch 'kris/request_protector_app' of git.bubblev.org:bubblev/bubble into kris/request_protector_app Extract method for updating requests host and port Fix header replacement Replace all cross-domain cookies with empty Add fqdn variable support in header replacements Merge branch 'master' into kris/request_protector_app Merge branch 'master' into kris/request_protector_app Merge branch 'master' into kris/request_protector_app Merge branch 'master' into kris/request_protector_app Add add header replacement button label Try to add initial header replacement for cross-domain cookies Merge branch 'master' into kris/request_protector_app Merge branch 'master' into kris/request_protector_app use special header replacement to skip emptied headers Set RequestProtector replacement optional again Fix replacement reference in RequestProtector app Update flex domains with empty set if needed Add back request heades modifiers as prime app Extract and refactor _primeApp method Merge branch 'master' into kris/request_protector_app # Conflicts - WIP: # bubble-server/src/main/java/bubble/service/stream/StandardAppPrimerService.java Use HeaderReplacement's id field in JSONs Make RequestProtector's replacement field required Add new app to some plans Set new app to have `app` presentation Add RuleDriver and AppMatcher for the new app Add request protector app Remove not used filter Merge branch 'master' into kris/request_protector_app Add full support for response header modification Merge branch 'master' into kris/request_protector_app # Conflicts: # utils/cobbzilla-utils Add RequestProtector app Co-authored-by: jonathan <jonathan@noreply.git.bubblev.org> Co-authored-by: Kristijan Mitrovic <kmitrovic@itekako.com> Reviewed-on: https://git.bubblev.org/bubblev/bubble/pulls/58
jonathan closed this pull request 4 years ago
jonathan deleted branch kris/request_protector_app 4 years ago

Reviewers

jonathan requested changes 4 years ago
The pull request has been merged as 237e90d126.
Sign in to join this conversation.
Reviewers
Request review
No reviewers
 jonathan
Labels
Apply labels
Clear labels
No items
No Label
Milestone
Set milestone
Clear milestone
No items
No Milestone
Assignees
Assign users
Clear assignees
No Assignees
 jonathan
2 Participants
Notifications
Due Date

No due date set.

Dependencies

This pull request currently doesn't have any dependencies.

Write Preview
Loading…
Cancel
Save
There is no content yet.
Delete Branch 'kris/request_protector_app'

Deleting a branch is permanent. It CANNOT be undone. Continue?

No
Yes