{"action":"created","comment":{"url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/comments/78080018","id":78080018,"diff_hunk":"@@ -1118,9 +1118,57 @@ tryProxyRequest = (hostId, req, res) => {\n \n     return Promise.resolve(true);\n   } else {\n-    const isAlreadyOpened = req.headers.cookie && req.headers.cookie.indexOf(\"sandstorm-sid=\") !== -1;\n+    const isAlreadyOpened = req.headers.cookie &&\n+        req.headers.cookie.indexOf(\"sandstorm-sid=\") !== -1;\n+\n     return getProxyForHostId(hostId, isAlreadyOpened).then((proxy) => {\n       if (proxy) {\n+        // Let's do some CSRF defense.\n+        const expectedOrigin = PROTOCOL + \"//\" + req.headers.host;","path":"shell/server/proxy.js","position":11,"original_position":11,"commit_id":"0da77ad03f36f11b6f9cd34dbfc3fcf66060c710","original_commit_id":"0da77ad03f36f11b6f9cd34dbfc3fcf66060c710","user":{"login":"thejh","id":499370,"avatar_url":"https://avatars.githubusercontent.com/u/499370?v=3","gravatar_id":"","url":"https://api.github.com/users/thejh","html_url":"https://github.com/thejh","followers_url":"https://api.github.com/users/thejh/followers","following_url":"https://api.github.com/users/thejh/following{/other_user}","gists_url":"https://api.github.com/users/thejh/gists{/gist_id}","starred_url":"https://api.github.com/users/thejh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thejh/subscriptions","organizations_url":"https://api.github.com/users/thejh/orgs","repos_url":"https://api.github.com/users/thejh/repos","events_url":"https://api.github.com/users/thejh/events{/privacy}","received_events_url":"https://api.github.com/users/thejh/received_events","type":"User","site_admin":false},"body":"You permit `mainUrl` in the `referer` case, but not the `origin` case, right?","created_at":"2016-09-08T20:11:56Z","updated_at":"2016-09-08T20:11:56Z","html_url":"https://github.com/sandstorm-io/sandstorm/pull/2512#discussion_r78080018","pull_request_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2512","_links":{"self":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/comments/78080018"},"html":{"href":"https://github.com/sandstorm-io/sandstorm/pull/2512#discussion_r78080018"},"pull_request":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2512"}}},"pull_request":{"url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2512","id":84377602,"html_url":"https://github.com/sandstorm-io/sandstorm/pull/2512","diff_url":"https://github.com/sandstorm-io/sandstorm/pull/2512.diff","patch_url":"https://github.com/sandstorm-io/sandstorm/pull/2512.patch","issue_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/2512","number":2512,"state":"open","locked":false,"title":"Harden against clickjacking and CSRF vulnerabilities in apps","user":{"login":"kentonv","id":4001805,"avatar_url":"https://avatars.githubusercontent.com/u/4001805?v=3","gravatar_id":"","url":"https://api.github.com/users/kentonv","html_url":"https://github.com/kentonv","followers_url":"https://api.github.com/users/kentonv/followers","following_url":"https://api.github.com/users/kentonv/following{/other_user}","gists_url":"https://api.github.com/users/kentonv/gists{/gist_id}","starred_url":"https://api.github.com/users/kentonv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kentonv/subscriptions","organizations_url":"https://api.github.com/users/kentonv/orgs","repos_url":"https://api.github.com/users/kentonv/repos","events_url":"https://api.github.com/users/kentonv/events{/privacy}","received_events_url":"https://api.github.com/users/kentonv/received_events","type":"User","site_admin":false},"body":"See individual commits for more info.","created_at":"2016-09-07T21:32:51Z","updated_at":"2016-09-08T20:11:56Z","closed_at":null,"merged_at":null,"merge_commit_sha":"1c197707d501bc2a4a9106fd3c9906ddd3b26e12","assignee":{"login":"dwrensha","id":495768,"avatar_url":"https://avatars.githubusercontent.com/u/495768?v=3","gravatar_id":"","url":"https://api.github.com/users/dwrensha","html_url":"https://github.com/dwrensha","followers_url":"https://api.github.com/users/dwrensha/followers","following_url":"https://api.github.com/users/dwrensha/following{/other_user}","gists_url":"https://api.github.com/users/dwrensha/gists{/gist_id}","starred_url":"https://api.github.com/users/dwrensha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dwrensha/subscriptions","organizations_url":"https://api.github.com/users/dwrensha/orgs","repos_url":"https://api.github.com/users/dwrensha/repos","events_url":"https://api.github.com/users/dwrensha/events{/privacy}","received_events_url":"https://api.github.com/users/dwrensha/received_events","type":"User","site_admin":false},"assignees":[{"login":"dwrensha","id":495768,"avatar_url":"https://avatars.githubusercontent.com/u/495768?v=3","gravatar_id":"","url":"https://api.github.com/users/dwrensha","html_url":"https://github.com/dwrensha","followers_url":"https://api.github.com/users/dwrensha/followers","following_url":"https://api.github.com/users/dwrensha/following{/other_user}","gists_url":"https://api.github.com/users/dwrensha/gists{/gist_id}","starred_url":"https://api.github.com/users/dwrensha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dwrensha/subscriptions","organizations_url":"https://api.github.com/users/dwrensha/orgs","repos_url":"https://api.github.com/users/dwrensha/repos","events_url":"https://api.github.com/users/dwrensha/events{/privacy}","received_events_url":"https://api.github.com/users/dwrensha/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2512/commits","review_comments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2512/comments","review_comment_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/comments{/number}","comments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/2512/comments","statuses_url":"https://api.github.com/repos/sandstorm-io/sandstorm/statuses/0da77ad03f36f11b6f9cd34dbfc3fcf66060c710","head":{"label":"sandstorm-io:mitigate-app-vulns","ref":"mitigate-app-vulns","sha":"0da77ad03f36f11b6f9cd34dbfc3fcf66060c710","user":{"login":"sandstorm-io","id":7479094,"avatar_url":"https://avatars.githubusercontent.com/u/7479094?v=3","gravatar_id":"","url":"https://api.github.com/users/sandstorm-io","html_url":"https://github.com/sandstorm-io","followers_url":"https://api.github.com/users/sandstorm-io/followers","following_url":"https://api.github.com/users/sandstorm-io/following{/other_user}","gists_url":"https://api.github.com/users/sandstorm-io/gists{/gist_id}","starred_url":"https://api.github.com/users/sandstorm-io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sandstorm-io/subscriptions","organizations_url":"https://api.github.com/users/sandstorm-io/orgs","repos_url":"https://api.github.com/users/sandstorm-io/repos","events_url":"https://api.github.com/users/sandstorm-io/events{/privacy}","received_events_url":"https://api.github.com/users/sandstorm-io/received_events","type":"Organization","site_admin":false},"repo":{"id":15728293,"name":"sandstorm","full_name":"sandstorm-io/sandstorm","owner":{"login":"sandstorm-io","id":7479094,"avatar_url":"https://avatars.githubusercontent.com/u/7479094?v=3","gravatar_id":"","url":"https://api.github.com/users/sandstorm-io","html_url":"https://github.com/sandstorm-io","followers_url":"https://api.github.com/users/sandstorm-io/followers","following_url":"https://api.github.com/users/sandstorm-io/following{/other_user}","gists_url":"https://api.github.com/users/sandstorm-io/gists{/gist_id}","starred_url":"https://api.github.com/users/sandstorm-io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sandstorm-io/subscriptions","organizations_url":"https://api.github.com/users/sandstorm-io/orgs","repos_url":"https://api.github.com/users/sandstorm-io/repos","events_url":"https://api.github.com/users/sandstorm-io/events{/privacy}","received_events_url":"https://api.github.com/users/sandstorm-io/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/sandstorm-io/sandstorm","description":"Self-hostable Web App Platform","fork":false,"url":"https://api.github.com/repos/sandstorm-io/sandstorm","forks_url":"https://api.github.com/repos/sandstorm-io/sandstorm/forks","keys_url":"https://api.github.com/repos/sandstorm-io/sandstorm/keys{/key_id}","collaborators_url":"https://api.github.com/repos/sandstorm-io/sandstorm/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/sandstorm-io/sandstorm/teams","hooks_url":"https://api.github.com/repos/sandstorm-io/sandstorm/hooks","issue_events_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/events{/number}","events_url":"https://api.github.com/repos/sandstorm-io/sandstorm/events","assignees_url":"https://api.github.com/repos/sandstorm-io/sandstorm/assignees{/user}","branches_url":"https://api.github.com/repos/sandstorm-io/sandstorm/branches{/branch}","tags_url":"https://api.github.com/repos/sandstorm-io/sandstorm/tags","blobs_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/refs{/sha}","trees_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/trees{/sha}","statuses_url":"https://api.github.com/repos/sandstorm-io/sandstorm/statuses/{sha}","languages_url":"https://api.github.com/repos/sandstorm-io/sandstorm/languages","stargazers_url":"https://api.github.com/repos/sandstorm-io/sandstorm/stargazers","contributors_url":"https://api.github.com/repos/sandstorm-io/sandstorm/contributors","subscribers_url":"https://api.github.com/repos/sandstorm-io/sandstorm/subscribers","subscription_url":"https://api.github.com/repos/sandstorm-io/sandstorm/subscription","commits_url":"https://api.github.com/repos/sandstorm-io/sandstorm/commits{/sha}","git_commits_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/commits{/sha}","comments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/comments{/number}","issue_comment_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/comments{/number}","contents_url":"https://api.github.com/repos/sandstorm-io/sandstorm/contents/{+path}","compare_url":"https://api.github.com/repos/sandstorm-io/sandstorm/compare/{base}...{head}","merges_url":"https://api.github.com/repos/sandstorm-io/sandstorm/merges","archive_url":"https://api.github.com/repos/sandstorm-io/sandstorm/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/sandstorm-io/sandstorm/downloads","issues_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues{/number}","pulls_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls{/number}","milestones_url":"https://api.github.com/repos/sandstorm-io/sandstorm/milestones{/number}","notifications_url":"https://api.github.com/repos/sandstorm-io/sandstorm/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/sandstorm-io/sandstorm/labels{/name}","releases_url":"https://api.github.com/repos/sandstorm-io/sandstorm/releases{/id}","deployments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/deployments","created_at":"2014-01-08T07:10:33Z","updated_at":"2016-09-08T14:03:15Z","pushed_at":"2016-09-08T19:24:56Z","git_url":"git://github.com/sandstorm-io/sandstorm.git","ssh_url":"git@github.com:sandstorm-io/sandstorm.git","clone_url":"https://github.com/sandstorm-io/sandstorm.git","svn_url":"https://github.com/sandstorm-io/sandstorm","homepage":"https://sandstorm.io","size":39485,"stargazers_count":3825,"watchers_count":3825,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":347,"mirror_url":null,"open_issues_count":443,"forks":347,"open_issues":443,"watchers":3825,"default_branch":"master"}},"base":{"label":"sandstorm-io:master","ref":"master","sha":"21864712bcd04b89c274a5229e874e77ee655997","user":{"login":"sandstorm-io","id":7479094,"avatar_url":"https://avatars.githubusercontent.com/u/7479094?v=3","gravatar_id":"","url":"https://api.github.com/users/sandstorm-io","html_url":"https://github.com/sandstorm-io","followers_url":"https://api.github.com/users/sandstorm-io/followers","following_url":"https://api.github.com/users/sandstorm-io/following{/other_user}","gists_url":"https://api.github.com/users/sandstorm-io/gists{/gist_id}","starred_url":"https://api.github.com/users/sandstorm-io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sandstorm-io/subscriptions","organizations_url":"https://api.github.com/users/sandstorm-io/orgs","repos_url":"https://api.github.com/users/sandstorm-io/repos","events_url":"https://api.github.com/users/sandstorm-io/events{/privacy}","received_events_url":"https://api.github.com/users/sandstorm-io/received_events","type":"Organization","site_admin":false},"repo":{"id":15728293,"name":"sandstorm","full_name":"sandstorm-io/sandstorm","owner":{"login":"sandstorm-io","id":7479094,"avatar_url":"https://avatars.githubusercontent.com/u/7479094?v=3","gravatar_id":"","url":"https://api.github.com/users/sandstorm-io","html_url":"https://github.com/sandstorm-io","followers_url":"https://api.github.com/users/sandstorm-io/followers","following_url":"https://api.github.com/users/sandstorm-io/following{/other_user}","gists_url":"https://api.github.com/users/sandstorm-io/gists{/gist_id}","starred_url":"https://api.github.com/users/sandstorm-io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sandstorm-io/subscriptions","organizations_url":"https://api.github.com/users/sandstorm-io/orgs","repos_url":"https://api.github.com/users/sandstorm-io/repos","events_url":"https://api.github.com/users/sandstorm-io/events{/privacy}","received_events_url":"https://api.github.com/users/sandstorm-io/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/sandstorm-io/sandstorm","description":"Self-hostable Web App Platform","fork":false,"url":"https://api.github.com/repos/sandstorm-io/sandstorm","forks_url":"https://api.github.com/repos/sandstorm-io/sandstorm/forks","keys_url":"https://api.github.com/repos/sandstorm-io/sandstorm/keys{/key_id}","collaborators_url":"https://api.github.com/repos/sandstorm-io/sandstorm/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/sandstorm-io/sandstorm/teams","hooks_url":"https://api.github.com/repos/sandstorm-io/sandstorm/hooks","issue_events_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/events{/number}","events_url":"https://api.github.com/repos/sandstorm-io/sandstorm/events","assignees_url":"https://api.github.com/repos/sandstorm-io/sandstorm/assignees{/user}","branches_url":"https://api.github.com/repos/sandstorm-io/sandstorm/branches{/branch}","tags_url":"https://api.github.com/repos/sandstorm-io/sandstorm/tags","blobs_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/refs{/sha}","trees_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/trees{/sha}","statuses_url":"https://api.github.com/repos/sandstorm-io/sandstorm/statuses/{sha}","languages_url":"https://api.github.com/repos/sandstorm-io/sandstorm/languages","stargazers_url":"https://api.github.com/repos/sandstorm-io/sandstorm/stargazers","contributors_url":"https://api.github.com/repos/sandstorm-io/sandstorm/contributors","subscribers_url":"https://api.github.com/repos/sandstorm-io/sandstorm/subscribers","subscription_url":"https://api.github.com/repos/sandstorm-io/sandstorm/subscription","commits_url":"https://api.github.com/repos/sandstorm-io/sandstorm/commits{/sha}","git_commits_url":"https://api.github.com/repos/sandstorm-io/sandstorm/git/commits{/sha}","comments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/comments{/number}","issue_comment_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/comments{/number}","contents_url":"https://api.github.com/repos/sandstorm-io/sandstorm/contents/{+path}","compare_url":"https://api.github.com/repos/sandstorm-io/sandstorm/compare/{base}...{head}","merges_url":"https://api.github.com/repos/sandstorm-io/sandstorm/merges","archive_url":"https://api.github.com/repos/sandstorm-io/sandstorm/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/sandstorm-io/sandstorm/downloads","issues_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues{/number}","pulls_url":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls{/number}","milestones_url":"https://api.github.com/repos/sandstorm-io/sandstorm/milestones{/number}","notifications_url":"https://api.github.com/repos/sandstorm-io/sandstorm/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/sandstorm-io/sandstorm/labels{/name}","releases_url":"https://api.github.com/repos/sandstorm-io/sandstorm/releases{/id}","deployments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/deployments","created_at":"2014-01-08T07:10:33Z","updated_at":"2016-09-08T14:03:15Z","pushed_at":"2016-09-08T19:24:56Z","git_url":"git://github.com/sandstorm-io/sandstorm.git","ssh_url":"git@github.com:sandstorm-io/sandstorm.git","clone_url":"https://github.com/sandstorm-io/sandstorm.git","svn_url":"https://github.com/sandstorm-io/sandstorm","homepage":"https://sandstorm.io","size":39485,"stargazers_count":3825,"watchers_count":3825,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":347,"mirror_url":null,"open_issues_count":443,"forks":347,"open_issues":443,"watchers":3825,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2512"},"html":{"href":"https://github.com/sandstorm-io/sandstorm/pull/2512"},"issue":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/2512"},"comments":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/2512/comments"},"review_comments":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2512/comments"},"review_comment":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/pulls/2512/commits"},"statuses":{"href":"https://api.github.com/repos/sandstorm-io/sandstorm/statuses/0da77ad03f36f11b6f9cd34dbfc3fcf66060c710"}}}}
{"actor":{"display_login":"thejh"}}