fix(security): validate Origin header on WebSocket /run_live endpoint#4948
fix(security): validate Origin header on WebSocket /run_live endpoint#4948luskabolas wants to merge 1 commit intogoogle:mainfrom
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
|
Response from ADK Triaging Agent Hello @luskabolas, thank you for your contribution! Before we can merge this PR, you'll need to sign a Contributor License Agreement (CLA). You can find more information in the "cla/google" check at the bottom of the pull request page. Thanks! |
|
Hi @luskabolas , Thank you for your contribution! We appreciate you taking the time to submit this pull request. Can you please fix the formatting errors and mypy-diff tests |
rohityan
added
request clarification
|
Hello @rohityan, Yes, I can do that. However, as @sirdarckcat pointed out in #4947, the more appropriate fix would be to add CSRF protection to the /builder/save endpoint, since that's where the malicious files enter the system, /run_live is just one of several ways to trigger execution. I'm currently working in a proper fix. |
Reject cross-origin POST requests to /builder/save and
/builder/app/{app_name}/cancel by checking the Origin header
against a set of allowed origins derived from the server's
host and port.
This prevents CSRF attacks where a malicious website could
upload arbitrary agent code to a victim's local ADK instance.
luskabolas
force-pushed
the
fix/websocket-origin-validation
branch
from
64ccf2d to
c6069a7
Compare
4 participants
Fixes #4947
Summary
/run_liveWebSocket endpoint does not validate theOriginheader, allowing cross-origin WebSocket connections from any webpage/builder/save(CORS-exempt simple POST) and trigger its execution through the WebSocket, achieving remote code executionhost/portand any user-provided--allow_originsvaluesTest plan
test_ws_rejects_cross_origin— foreign origin is closed with code 1008test_ws_allows_same_origin— server's own origin is not rejected