Merge lp:~julian-edwards/maas/1.4-xss-bug-1251336 into lp:maas/1.4

[Julian Edwards]

Fix XSS in API calls that have no valid operation

[Julian Edwards (julian-edwards)]

Selfing. Approved on trunk.

review: Approve

=== modified file 'src/maasserver/api_support.py'
--- src/maasserver/api_support.py	2013-10-07 09:12:40 +0000
+++ src/maasserver/api_support.py	2014-02-06 03:17:25 +0000
@@ -19,7 +19,7 @@
     ]
 
 from django.core.exceptions import PermissionDenied
-from django.http import HttpResponseBadRequest
+from maasserver.exceptions import MAASAPIBadRequest
 from piston.handler import (
     AnonymousBaseHandler,
     BaseHandler,
@@ -141,7 +141,7 @@
         signature = request.method.upper(), request.REQUEST.get("op")
         function = self.exports.get(signature)
         if function is None:
-            return HttpResponseBadRequest(
+            raise MAASAPIBadRequest(
                 "Unrecognised signature: %s %s" % signature)
         else:
             return function(self, request, *args, **kwargs)

=== modified file 'src/maasserver/tests/test_api.py'
--- src/maasserver/tests/test_api.py	2013-10-07 09:12:40 +0000
+++ src/maasserver/tests/test_api.py	2014-02-06 03:17:25 +0000
@@ -101,6 +101,17 @@
         self.assertThat(observed, MatchesListwise(expected))
 
 
+class TestXSSBugs(MAASServerTestCase):
+    """Tests for making sure we don't allow cross-site scripting bugs."""
+
+    def test_invalid_signature_response_is_textplain(self):
+        response = self.client.get(
+            reverse('nodes_handler'),
+            {'op': '<script>alert(document.domain)</script>'})
+        self.assertIn("text/plain", response.get("Content-Type"))
+        self.assertNotIn("text/html", response.get("Content-Type"))
+
+
 class TestStoreNodeParameters(MAASServerTestCase):
     """Tests for `store_node_power_parameters`."""
 

=== modified file 'src/maasserver/tests/test_api_enlistment.py'
--- src/maasserver/tests/test_api_enlistment.py	2013-10-07 09:12:40 +0000
+++ src/maasserver/tests/test_api_enlistment.py	2014-02-06 03:17:25 +0000
@@ -254,7 +254,7 @@
             })
 
         self.assertEqual(httplib.BAD_REQUEST, response.status_code)
-        self.assertIn('text/html', response['Content-Type'])
+        self.assertIn('text/plain', response['Content-Type'])
         self.assertEqual(
             "Unrecognised signature: POST None",
             response.content)

=== modified file 'src/maasserver/views/combo.py'
--- src/maasserver/views/combo.py	2013-10-07 09:12:40 +0000
+++ src/maasserver/views/combo.py	2014-02-06 03:17:25 +0000
@@ -97,7 +97,9 @@
             return HttpResponseRedirect(
                 "%s%s" % (default_redirect, fnames[0]))
         else:
-            return HttpResponseBadRequest("Invalid file type requested.")
+            return HttpResponseBadRequest(
+                "Invalid file type requested.",
+                content_type="text/plain; charset=UTF-8")
         content = "".join(
             [content.decode(encoding) for content in combine_files(
                fnames, location, resource_prefix='/', rewrite_urls=True)])