{"action":"created","issue":{"url":"https://api.github.com/repos/rust-cn/rust_lang_cn/issues/15","repository_url":"https://api.github.com/repos/rust-cn/rust_lang_cn","labels_url":"https://api.github.com/repos/rust-cn/rust_lang_cn/issues/15/labels{/name}","comments_url":"https://api.github.com/repos/rust-cn/rust_lang_cn/issues/15/comments","events_url":"https://api.github.com/repos/rust-cn/rust_lang_cn/issues/15/events","html_url":"https://github.com/rust-cn/rust_lang_cn/issues/15","id":162076372,"number":15,"title":"CSRF 和一些其他安全问题","user":{"login":"quininer","id":6286761,"avatar_url":"https://avatars.githubusercontent.com/u/6286761?v=3","gravatar_id":"","url":"https://api.github.com/users/quininer","html_url":"https://github.com/quininer","followers_url":"https://api.github.com/users/quininer/followers","following_url":"https://api.github.com/users/quininer/following{/other_user}","gists_url":"https://api.github.com/users/quininer/gists{/gist_id}","starred_url":"https://api.github.com/users/quininer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quininer/subscriptions","organizations_url":"https://api.github.com/users/quininer/orgs","repos_url":"https://api.github.com/users/quininer/repos","events_url":"https://api.github.com/users/quininer/events{/privacy}","received_events_url":"https://api.github.com/users/quininer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-06-24T05:01:57Z","updated_at":"2016-06-24T05:44:02Z","closed_at":null,"body":"[POC](http://quininer.github.io/tests/#PHNjcmlwdCBzcmM9Imh0dHA6Ly9xdWluaW5lci5naXRodWIuaW8vdGVzdHMvZ3VtLmpzIj48L3NjcmlwdD4KPHNjcmlwdD4KICAgIGd1bS5wb3N0KCJodHRwOi8vcnVzdC1sYW5nLWNuLm9yZy91c2VyL2xvZ291dCIpOwo8L3NjcmlwdD4=)\r\n\r\n访问后会发现你的 http://rust-lang-cn.org/ 被 lougout 了，实际上还可以用来进行发帖回帖之类的操作。\r\n修复方案可以是检查 Referer 或者加 CSRF Token。\r\n\r\n另外还有一些其他的小问题:\r\n1. 固定的`logined cookie`（其实是`iron-login`的问题），实际上可以加一个`nonce`避免每次的`MAC`都一样。[handlers/user.rs#L600](https://github.com/rust-cn/rust_lang_cn/blob/master/src/handlers/user.rs#L600)\r\n2. 非常数时间的密码比较，可以用 [constant_time_eq](https://github.com/cesarb/constant_time_eq)。[handlers/user.rs#L626](https://github.com/rust-cn/rust_lang_cn/blob/master/src/handlers/user.rs#L626)\r\n3. 过弱的`password hash`，建议使用 [argon2](https://github.com/bryant/argon2rs)。[handlers/user.rs#L81](https://github.com/rust-cn/rust_lang_cn/blob/master/src/handlers/user.rs#L81)"},"comment":{"url":"https://api.github.com/repos/rust-cn/rust_lang_cn/issues/comments/228262795","html_url":"https://github.com/rust-cn/rust_lang_cn/issues/15#issuecomment-228262795","issue_url":"https://api.github.com/repos/rust-cn/rust_lang_cn/issues/15","id":228262795,"user":{"login":"liyuan462","id":1780704,"avatar_url":"https://avatars.githubusercontent.com/u/1780704?v=3","gravatar_id":"","url":"https://api.github.com/users/liyuan462","html_url":"https://github.com/liyuan462","followers_url":"https://api.github.com/users/liyuan462/followers","following_url":"https://api.github.com/users/liyuan462/following{/other_user}","gists_url":"https://api.github.com/users/liyuan462/gists{/gist_id}","starred_url":"https://api.github.com/users/liyuan462/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liyuan462/subscriptions","organizations_url":"https://api.github.com/users/liyuan462/orgs","repos_url":"https://api.github.com/users/liyuan462/repos","events_url":"https://api.github.com/users/liyuan462/events{/privacy}","received_events_url":"https://api.github.com/users/liyuan462/received_events","type":"User","site_admin":false},"created_at":"2016-06-24T05:44:01Z","updated_at":"2016-06-24T05:44:01Z","body":"@quininer 嗯， 谢谢指出，CSRF 我没有防，我会先加上referer检查"}}
{"actor":{"display_login":"liyuan462"}}