File protect_against_DNS_rebinding.patch of Package python-mitmproxy

Overview Repositories Revisions Requests Users Attributes Meta

File protect_against_DNS_rebinding.patch of Package python-mitmproxy (Revision 0aedc46e46dae23eb6243db9a4947f55)

Currently displaying revision 0aedc46e46dae23eb6243db9a4947f55 , Show latest

From f196d776d227418068cd8505323c8585a1b1504b Mon Sep 17 00:00:00 2001
From: Maximilian Hils <git@maximilianhils.com>
Date: Wed, 11 Jul 2018 18:56:49 +0800
Subject: [PATCH] mitmweb: protect against dns rebinding

---
 mitmproxy/tools/web/app.py | 56 +++++++++++++++++++++++++---------------------
 1 file changed, 30 insertions(+), 26 deletions(-)

Index: mitmproxy-3.0.4/mitmproxy/tools/web/app.py
===================================================================
--- mitmproxy-3.0.4.orig/mitmproxy/tools/web/app.py
+++ mitmproxy-3.0.4/mitmproxy/tools/web/app.py
@@ -465,31 +465,7 @@ class SaveOptions(RequestHandler):
 class Application(tornado.web.Application):
     def __init__(self, master, debug):
         self.master = master
-        handlers = [
-            (r"/", IndexHandler),
-            (r"/filter-help(?:\.json)?", FilterHelp),
-            (r"/updates", ClientConnection),
-            (r"/events(?:\.json)?", Events),
-            (r"/flows(?:\.json)?", Flows),
-            (r"/flows/dump", DumpFlows),
-            (r"/flows/resume", ResumeFlows),
-            (r"/flows/kill", KillFlows),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)", FlowHandler),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/resume", ResumeFlow),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/kill", KillFlow),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/duplicate", DuplicateFlow),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/replay", ReplayFlow),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/revert", RevertFlow),
-            (r"/flows/(?P<flow_id>[0-9a-f\-]+)/(?P<message>request|response)/content.data", FlowContent),
-            (
-                r"/flows/(?P<flow_id>[0-9a-f\-]+)/(?P<message>request|response)/content/(?P<content_view>[0-9a-zA-Z\-\_]+)(?:\.json)?",
-                FlowContentView),
-            (r"/settings(?:\.json)?", Settings),
-            (r"/clear", ClearAll),
-            (r"/options(?:\.json)?", Options),
-            (r"/options/save", SaveOptions)
-        ]
-        settings = dict(
+        super().__init__(
             template_path=os.path.join(os.path.dirname(__file__), "templates"),
             static_path=os.path.join(os.path.dirname(__file__), "static"),
             xsrf_cookies=True,
@@ -497,4 +473,32 @@ class Application(tornado.web.Applicatio
             debug=debug,
             autoreload=False,
         )
-        super().__init__(handlers, **settings)
+
+        self.add_handlers(
+            # make mitmweb accessible by IP only to prevent DNS rebinding.
+            r'(localhost|\d+\.\d+\.\d+\.\d+)',
+            [
+                (r"/", IndexHandler),
+                (r"/filter-help(?:\.json)?", FilterHelp),
+                (r"/updates", ClientConnection),
+                (r"/events(?:\.json)?", Events),
+                (r"/flows(?:\.json)?", Flows),
+                (r"/flows/dump", DumpFlows),
+                (r"/flows/resume", ResumeFlows),
+                (r"/flows/kill", KillFlows),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)", FlowHandler),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/resume", ResumeFlow),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/kill", KillFlow),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/duplicate", DuplicateFlow),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/replay", ReplayFlow),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/revert", RevertFlow),
+                (r"/flows/(?P<flow_id>[0-9a-f\-]+)/(?P<message>request|response)/content.data", FlowContent),
+                (
+                    r"/flows/(?P<flow_id>[0-9a-f\-]+)/(?P<message>request|response)/content/(?P<content_view>[0-9a-zA-Z\-\_]+)(?:\.json)?",
+                    FlowContentView),
+                (r"/settings(?:\.json)?", Settings),
+                (r"/clear", ClearAll),
+                (r"/options(?:\.json)?", Options),
+                (r"/options/save", SaveOptions)
+            ]
+        )

Places

File protect_against_DNS_rebinding.patch of Package python-mitmproxy (Revision 0aedc46e46dae23eb6243db9a4947f55)

Places