Add request protector app with cross-domain cookies filtering

Discussie 4 Commits 35 Bestanden gewijzigd 17

@jonathan please review

Waiting on Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/252/
but not sure how it will go as current master build is failing.

jonathan was toegekend door kris 4 jaren geleden

Looks good, but what would the regex be if the intent is “delete any cookies NOT belonging to the current domain, or one of its subdomains”?

It seems like we would need some more logic -- if we add these 2 things I think it would work:

The regex can include {{fqdn}} which will be replaced (in mitm-land) with the (regex-escaped) FQDN for the current request
In addition to regex and replacement, add mode which can be match or no_match. Or, alternatively, see if the “regex negation” syntax works in Python’s regex implementation, see: https://stackoverflow.com/questions/2637675/how-to-negate-the-whole-regex ). If regex negation works, that may be easier.

Thoughts?

will do. Separate PR? (easier review)
(?!...) is supported in python3’s re

will do. Separate PR? (easier review)

No, let’s do it in this one. And test it :) this will be very cool when it works!

(?!...) is supported in python3’s re

That’s good news. Let’s do that.

👍 1

kris titel aangepast van ~~Add request protector app with cross-domain cookies filtering~~ naar WIP: (testing after fqdn part) Add request protector app with cross-domain cookies filtering 4 jaren geleden

kris titel aangepast van ~~WIP: (testing after fqdn part) Add request protector app with cross-domain cookies filtering~~ naar Add request protector app with cross-domain cookies filtering 4 jaren geleden

kris titel aangepast van ~~Add request protector app with cross-domain cookies filtering~~ naar WIP: (waiting on fresh Jenkins build) Add request protector app with cross-domain cookies filtering 4 jaren geleden

kris titel aangepast van ~~WIP: (waiting on fresh Jenkins build) Add request protector app with cross-domain cookies filtering~~ naar Add request protector app with cross-domain cookies filtering 4 jaren geleden

Passing Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/260/

jonathan aangevraagde wijzigingen 4 jaren geleden

minor changes requested.

bubble-server/src/main/resources/models/defaults/bubblePlan.json

												
			@@ -38,2 +38,3 @@
		
			        {"app": "UserBlocker"},
		
			        {"app": "TlsPassthru"}
		
			        {"app": "TlsPassthru"},
		
			        {"app": "RequestProtector"}

jonathan commented 4 jaren geleden

Let’s add RequestProtector app to all plans.

bubble-server/src/main/resources/packer/roles/mitmproxy/files/bubble_api.py

jonathan verwees naar dit probleem vanuit commit 4 jaren geleden'

jonathan heeft deze pull request gesloten 4 jaren geleden

jonathan heeft 4 jaren geleden de branch kris/request_protector_app verwijderd.

Reviewers

jonathan aangevraagde wijzigingen 4 jaren geleden

The pull request has been merged as 237e90d126.

Log in om deel te nemen aan deze discussie.

jonathan

Geen label

Geen mijlpaal

jonathan

2 deelnemers

Notificaties

Vervaldatum

Geen vervaldatum ingesteld.

Afhankelijkheden

Deze pull-aanvraag heeft momenteel geen afhankelijkheden.

@@ -452,0 +487,4 @@
 def _replace_in_headers(headers: nheaders.Headers, modifiers_dict: dict) -> int:
     """
     Taken from original mitmproxy's Header class implementation with sligh change to allow replacement with empty string

#58 Add request protector app with cross-domain cookies filtering

Reviewers