bubblev
/
bubble
9
0
Fork 0
Código Incidencias 0 Pull Requests 0 Lanzamientos 130 Wiki Actividad
Etiquetas Hitos
Nuevo Pull Request

#58 Add request protector app with cross-domain cookies filtering

Fusionado
jonathan fusionados 35 commits de kris/request_protector_app en master hace 4 años
Conversación 4 Commits 35 Archivos modificados 17
kris comentado hace 4 años

@jonathan please review

Waiting on Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/252/
but not sure how it will go as current master build is failing.

@jonathan please review Waiting on Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/252/ but not sure how it will go as current master build is failing.
jonathan fue asignado por kris hace 4 años
jonathan comentado hace 4 años
Propietario

Looks good, but what would the regex be if the intent is “delete any cookies NOT belonging to the current domain, or one of its subdomains”?

It seems like we would need some more logic -- if we add these 2 things I think it would work:

  1. The regex can include {{fqdn}} which will be replaced (in mitm-land) with the (regex-escaped) FQDN for the current request
  2. In addition to regex and replacement, add mode which can be match or no_match. Or, alternatively, see if the “regex negation” syntax works in Python’s regex implementation, see: https://stackoverflow.com/questions/2637675/how-to-negate-the-whole-regex ). If regex negation works, that may be easier.

Thoughts?

Looks good, but what would the regex be if the intent is "delete any cookies NOT belonging to the current domain, or one of its subdomains"? It seems like we would need some more logic -- if we add these 2 things I think it would work: 1. The regex can include `{{fqdn}}` which will be replaced (in mitm-land) with the (regex-escaped) FQDN for the current request 2. In addition to `regex` and `replacement`, add `mode` which can be `match` or `no_match`. Or, alternatively, see if the "regex negation" syntax works in Python's regex implementation, see: https://stackoverflow.com/questions/2637675/how-to-negate-the-whole-regex ). If regex negation works, that may be easier. Thoughts?
kris comentado hace 4 años
Autor
  1. will do. Separate PR? (easier review)
  2. (?!...) is supported in python3’s re
1. will do. Separate PR? (easier review) 2. `(?!...)` is supported in python3's `re`
jonathan comentado hace 4 años
Propietario
  1. will do. Separate PR? (easier review)

No, let’s do it in this one. And test it :) this will be very cool when it works!

  1. (?!...) is supported in python3’s re

That’s good news. Let’s do that.

> 1. will do. Separate PR? (easier review) No, let's do it in this one. And test it :) this will be very cool when it works! > 2. `(?!...)` is supported in python3's `re` That's good news. Let's do that.
👍 1
kris cambió el título de Add request protector app with cross-domain cookies filtering a WIP: (testing after fqdn part) Add request protector app with cross-domain cookies filtering hace 4 años
kris cambió el título de WIP: (testing after fqdn part) Add request protector app with cross-domain cookies filtering a Add request protector app with cross-domain cookies filtering hace 4 años
kris cambió el título de Add request protector app with cross-domain cookies filtering a WIP: (waiting on fresh Jenkins build) Add request protector app with cross-domain cookies filtering hace 4 años
kris cambió el título de WIP: (waiting on fresh Jenkins build) Add request protector app with cross-domain cookies filtering a Add request protector app with cross-domain cookies filtering hace 4 años
kris comentado hace 4 años
Autor

Passing Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/260/

Passing Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/260/
jonathan cambios solicitados hace 4 años
jonathan dejó un comentario

minor changes requested.

bubble-server/src/main/resources/models/defaults/bubblePlan.json
@@ -38,2 +38,3 @@
{"app": "UserBlocker"},
{"app": "TlsPassthru"}
{"app": "TlsPassthru"},
{"app": "RequestProtector"}
jonathan comentado hace 4 años

Let’s add RequestProtector app to all plans.

Let's add `RequestProtector` app to all plans.
bubble-server/src/main/resources/packer/roles/mitmproxy/files/bubble_api.py
@@ -452,0 +487,4 @@

def _replace_in_headers(headers: nheaders.Headers, modifiers_dict: dict) -> int:
"""
Taken from original mitmproxy's Header class implementation with sligh change to allow replacement with empty string
jonathan comentado hace 4 años

r/sligh/slight/

`r/sligh/slight/`
kris comentado hace 4 años

Actully, I’ll remove this second part completely as I did a larger changes here recently

Actully, I'll remove this second part completely as I did a larger changes here recently
jonathan referenció esta incidencia en un commit hace 4 años
Add request protector app with cross-domain cookies filtering (#58) Add RequestProtector app to cheapest plan Update comment with typo Merge branch 'master' into kris/request_protector_app Merge branch 'master' into kris/request_protector_app Merge branch 'kris/request_protector_app' of git.bubblev.org:bubblev/bubble into kris/request_protector_app Extract method for updating requests host and port Fix header replacement Replace all cross-domain cookies with empty Add fqdn variable support in header replacements Merge branch 'master' into kris/request_protector_app Merge branch 'master' into kris/request_protector_app Merge branch 'master' into kris/request_protector_app Merge branch 'master' into kris/request_protector_app Add add header replacement button label Try to add initial header replacement for cross-domain cookies Merge branch 'master' into kris/request_protector_app Merge branch 'master' into kris/request_protector_app use special header replacement to skip emptied headers Set RequestProtector replacement optional again Fix replacement reference in RequestProtector app Update flex domains with empty set if needed Add back request heades modifiers as prime app Extract and refactor _primeApp method Merge branch 'master' into kris/request_protector_app # Conflicts - WIP: # bubble-server/src/main/java/bubble/service/stream/StandardAppPrimerService.java Use HeaderReplacement's id field in JSONs Make RequestProtector's replacement field required Add new app to some plans Set new app to have `app` presentation Add RuleDriver and AppMatcher for the new app Add request protector app Remove not used filter Merge branch 'master' into kris/request_protector_app Add full support for response header modification Merge branch 'master' into kris/request_protector_app # Conflicts: # utils/cobbzilla-utils Add RequestProtector app Co-authored-by: jonathan <jonathan@noreply.git.bubblev.org> Co-authored-by: Kristijan Mitrovic <kmitrovic@itekako.com> Reviewed-on: https://git.bubblev.org/bubblev/bubble/pulls/58
jonathan cerró este pull request hace 4 años
jonathan rama eliminada kris/request_protector_app hace 4 años

Revisores

jonathan cambios solicitados hace 4 años
El Pull Request se ha fusionado como 237e90d126.
Inicie sesión para unirse a esta conversación.
Revisores
Solicitar revisión
No hay revisores
 jonathan
Etiquetas
Aplicar etiquetas
Limpiar etiquetas
No hay elementos
Sin etiquetas
Milestone
Fijar hito
Limpiar Milestone
No hay elementos
Sin Milestone
Asignados
Asignar usuarios
Limpiar asignados
No asignados
 jonathan
2 participantes
Notificaciones
Fecha de vencimiento

Sin fecha de vencimiento.

Dependencias

Este pull request actualmente no tiene ninguna dependencia.

Escribir Vista previa
Cargando…
Cancelar
Guardar
Aún no existe contenido.
Eliminar la rama con el nombre 'kris/request_protector_app'

Eliminar una rama es permanente. NO PUEDE deshacerse. ¿Continuar?

No
Sí