Add request protector app with cross-domain cookies filtering

@jonathan please review

Waiting on Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/252/
but not sure how it will go as current master build is failing.

jonathan 다음으로부터 할당됨 kris 4 년 전

Looks good, but what would the regex be if the intent is “delete any cookies NOT belonging to the current domain, or one of its subdomains”?

It seems like we would need some more logic -- if we add these 2 things I think it would work:

The regex can include {{fqdn}} which will be replaced (in mitm-land) with the (regex-escaped) FQDN for the current request
In addition to regex and replacement, add mode which can be match or no_match. Or, alternatively, see if the “regex negation” syntax works in Python’s regex implementation, see: https://stackoverflow.com/questions/2637675/how-to-negate-the-whole-regex ). If regex negation works, that may be easier.

Thoughts?

will do. Separate PR? (easier review)
(?!...) is supported in python3’s re

will do. Separate PR? (easier review)

No, let’s do it in this one. And test it :) this will be very cool when it works!

(?!...) is supported in python3’s re

That’s good news. Let’s do that.

👍 1

kris changed title from ~~Add request protector app with cross-domain cookies filtering~~ to WIP: (testing after fqdn part) Add request protector app with cross-domain cookies filtering 4 년 전

kris changed title from ~~WIP: (testing after fqdn part) Add request protector app with cross-domain cookies filtering~~ to Add request protector app with cross-domain cookies filtering 4 년 전

kris changed title from ~~Add request protector app with cross-domain cookies filtering~~ to WIP: (waiting on fresh Jenkins build) Add request protector app with cross-domain cookies filtering 4 년 전

kris changed title from ~~WIP: (waiting on fresh Jenkins build) Add request protector app with cross-domain cookies filtering~~ to Add request protector app with cross-domain cookies filtering 4 년 전

Passing Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/260/

jonathan requested changes 4 년 전

minor changes requested.

bubble-server/src/main/resources/models/defaults/bubblePlan.json

												
			@@ -38,2 +38,3 @@
		
			        {"app": "UserBlocker"},
		
			        {"app": "TlsPassthru"}
		
			        {"app": "TlsPassthru"},
		
			        {"app": "RequestProtector"}

jonathan 코멘트됨, 4 년 전

Let’s add RequestProtector app to all plans.

bubble-server/src/main/resources/packer/roles/mitmproxy/files/bubble_api.py

jonathan 커밋 4 년 전에서 이 이슈 언급

jonathan closed this pull request 4 년 전

jonathan 삭제된 브랜치 kris/request_protector_app 4 년 전

리뷰어

jonathan requested changes 4 년 전

The pull request has been merged as 237e90d126.

로그인하여 이 대화에 참여

jonathan

레이블 없음

마일스톤 없음

jonathan

참여자 2명

알림

마감일

마감일이 설정되지 않았습니다.

의존성

이 풀 리퀘스트는 어떠한 의존성도 가지지 않습니다.

@@ -452,0 +487,4 @@
 def _replace_in_headers(headers: nheaders.Headers, modifiers_dict: dict) -> int:
     """
     Taken from original mitmproxy's Header class implementation with sligh change to allow replacement with empty string

#58 Add request protector app with cross-domain cookies filtering

리뷰어