Add request protector app with cross-domain cookies filtering

Conversação 4 Commits 35 Arquivos alterados 17

@jonathan please review

Waiting on Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/252/
but not sure how it will go as current master build is failing.

jonathan foi atribuído por kris 4 anos atrás

Looks good, but what would the regex be if the intent is “delete any cookies NOT belonging to the current domain, or one of its subdomains”?

It seems like we would need some more logic -- if we add these 2 things I think it would work:

The regex can include {{fqdn}} which will be replaced (in mitm-land) with the (regex-escaped) FQDN for the current request
In addition to regex and replacement, add mode which can be match or no_match. Or, alternatively, see if the “regex negation” syntax works in Python’s regex implementation, see: https://stackoverflow.com/questions/2637675/how-to-negate-the-whole-regex ). If regex negation works, that may be easier.

Thoughts?

will do. Separate PR? (easier review)
(?!...) is supported in python3’s re

will do. Separate PR? (easier review)

No, let’s do it in this one. And test it :) this will be very cool when it works!

(?!...) is supported in python3’s re

That’s good news. Let’s do that.

👍 1

kris alterou o título de ~~Add request protector app with cross-domain cookies filtering~~ para WIP: (testing after fqdn part) Add request protector app with cross-domain cookies filtering 4 anos atrás

kris alterou o título de ~~WIP: (testing after fqdn part) Add request protector app with cross-domain cookies filtering~~ para Add request protector app with cross-domain cookies filtering 4 anos atrás

kris alterou o título de ~~Add request protector app with cross-domain cookies filtering~~ para WIP: (waiting on fresh Jenkins build) Add request protector app with cross-domain cookies filtering 4 anos atrás

kris alterou o título de ~~WIP: (waiting on fresh Jenkins build) Add request protector app with cross-domain cookies filtering~~ para Add request protector app with cross-domain cookies filtering 4 anos atrás

Passing Jenkins build: https://jenkins.bubblev.org/job/bubble-dev-kris/260/

jonathan alterações solicitadas 4 anos atrás

minor changes requested.

bubble-server/src/main/resources/models/defaults/bubblePlan.json

												
			@@ -38,2 +38,3 @@
		
			        {"app": "UserBlocker"},
		
			        {"app": "TlsPassthru"}
		
			        {"app": "TlsPassthru"},
		
			        {"app": "RequestProtector"}

jonathan comentou 4 anos atrás

Let’s add RequestProtector app to all plans.

bubble-server/src/main/resources/packer/roles/mitmproxy/files/bubble_api.py

jonathan citou esta issue em um commit 4 anos atrás

jonathan closed this pull request 4 anos atrás

jonathan excluiu branch kris/request_protector_app 4 anos atrás

Revisores

jonathan alterações solicitadas 4 anos atrás

O pull request teve merge aplicado como 237e90d126.

Acesse para participar desta conversação.

jonathan

Sem etiqueta

Sem marco

jonathan

2 participante(s)

Notificações

Data limite

Data limite não informada.

Dependências

Atualmente este pull request não tem dependências.

@@ -452,0 +487,4 @@
 def _replace_in_headers(headers: nheaders.Headers, modifiers_dict: dict) -> int:
     """
     Taken from original mitmproxy's Header class implementation with sligh change to allow replacement with empty string

#58 Add request protector app with cross-domain cookies filtering

Revisores