{"action":"created","comment":{"url":"https://api.github.com/repos/openfun/marsha/pulls/comments/233916560","pull_request_review_id":175441618,"id":233916560,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzMzkxNjU2MA==","diff_hunk":"@@ -84,7 +85,17 @@ def verify(self):\n         ):\n             raise LTIException()\n \n-        return passport.consumer_site or passport.playlist.consumer_site\n+        consumer_site = passport.consumer_site or passport.playlist.consumer_site\n+\n+        # Make sure we only accept requests from a domain matching the consumer_site associated\n+        # with the passport.\n+        if (\n+            urlparse(self.request.META.get(\"HTTP_REFERER\")).hostname","path":"src/backend/marsha/core/lti.py","position":17,"original_position":17,"commit_id":"4609875295810b7e6bee159a0a064ef8843d96a6","original_commit_id":"4609875295810b7e6bee159a0a064ef8843d96a6","user":{"login":"sampaccoud","id":1427165,"node_id":"MDQ6VXNlcjE0MjcxNjU=","avatar_url":"https://avatars3.githubusercontent.com/u/1427165?v=4","gravatar_id":"","url":"https://api.github.com/users/sampaccoud","html_url":"https://github.com/sampaccoud","followers_url":"https://api.github.com/users/sampaccoud/followers","following_url":"https://api.github.com/users/sampaccoud/following{/other_user}","gists_url":"https://api.github.com/users/sampaccoud/gists{/gist_id}","starred_url":"https://api.github.com/users/sampaccoud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sampaccoud/subscriptions","organizations_url":"https://api.github.com/users/sampaccoud/orgs","repos_url":"https://api.github.com/users/sampaccoud/repos","events_url":"https://api.github.com/users/sampaccoud/events{/privacy}","received_events_url":"https://api.github.com/users/sampaccoud/received_events","type":"User","site_admin":false},"body":"> This header is added by the browser so it can be craft by an attacker.\r\n\r\nWhat we are trying to prevent here is: \"someone we trust and gave a passport to is using the passport on another site than the site for which we gave them the passport\"\r\n\r\nI don't think our ambition here is to block an attacker who would handcraft a request after stealing valid passport credentials...","created_at":"2018-11-15T16:31:53Z","updated_at":"2018-11-15T16:31:53Z","html_url":"https://github.com/openfun/marsha/pull/144#discussion_r233916560","pull_request_url":"https://api.github.com/repos/openfun/marsha/pulls/144","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/openfun/marsha/pulls/comments/233916560"},"html":{"href":"https://github.com/openfun/marsha/pull/144#discussion_r233916560"},"pull_request":{"href":"https://api.github.com/repos/openfun/marsha/pulls/144"}},"in_reply_to_id":233833106},"pull_request":{"url":"https://api.github.com/repos/openfun/marsha/pulls/144","id":230919072,"node_id":"MDExOlB1bGxSZXF1ZXN0MjMwOTE5MDcy","html_url":"https://github.com/openfun/marsha/pull/144","diff_url":"https://github.com/openfun/marsha/pull/144.diff","patch_url":"https://github.com/openfun/marsha/pull/144.patch","issue_url":"https://api.github.com/repos/openfun/marsha/issues/144","number":144,"state":"open","locked":false,"title":"Add origin checks to lti video","user":{"login":"mbenadda","id":1932937,"node_id":"MDQ6VXNlcjE5MzI5Mzc=","avatar_url":"https://avatars0.githubusercontent.com/u/1932937?v=4","gravatar_id":"","url":"https://api.github.com/users/mbenadda","html_url":"https://github.com/mbenadda","followers_url":"https://api.github.com/users/mbenadda/followers","following_url":"https://api.github.com/users/mbenadda/following{/other_user}","gists_url":"https://api.github.com/users/mbenadda/gists{/gist_id}","starred_url":"https://api.github.com/users/mbenadda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbenadda/subscriptions","organizations_url":"https://api.github.com/users/mbenadda/orgs","repos_url":"https://api.github.com/users/mbenadda/repos","events_url":"https://api.github.com/users/mbenadda/events{/privacy}","received_events_url":"https://api.github.com/users/mbenadda/received_events","type":"User","site_admin":false},"body":"## Purpose\r\n\r\nOur `/lti-video/` view is meant to be run as an iframe target. As an LTI endpoint, it's authenticated and, if compromise, could expose data that should be restricted to authorized users.\r\n\r\nWe have some additional attack surface with `iframe-resizer` as `postMessage` as an API is inherently vulnerable to XSS. The library mitigates this by allowing us to whitelist domains on both sides of the iframe barrier.\r\n\r\nNB: Host side whitelisting is not in Marsha's scope as Marsha is supposed to be the iframe target, not the host.\r\n\r\n## Proposal\r\n\r\nOrigin checks should add a layer of protection in case LTI authentication somehow proves insufficient.\r\n\r\n- [x] add a domain check to LTI verification: iframe POST referer must match consumer site domain;\r\n- [x] whitelist the consumer site domain for `iframe-resizer`.\r\n","created_at":"2018-11-14T17:26:50Z","updated_at":"2018-11-15T16:31:53Z","closed_at":null,"merged_at":null,"merge_commit_sha":"a40fbb9dd1d79fe309d84f76ffdf3d49c2264b76","assignee":{"login":"mbenadda","id":1932937,"node_id":"MDQ6VXNlcjE5MzI5Mzc=","avatar_url":"https://avatars0.githubusercontent.com/u/1932937?v=4","gravatar_id":"","url":"https://api.github.com/users/mbenadda","html_url":"https://github.com/mbenadda","followers_url":"https://api.github.com/users/mbenadda/followers","following_url":"https://api.github.com/users/mbenadda/following{/other_user}","gists_url":"https://api.github.com/users/mbenadda/gists{/gist_id}","starred_url":"https://api.github.com/users/mbenadda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbenadda/subscriptions","organizations_url":"https://api.github.com/users/mbenadda/orgs","repos_url":"https://api.github.com/users/mbenadda/repos","events_url":"https://api.github.com/users/mbenadda/events{/privacy}","received_events_url":"https://api.github.com/users/mbenadda/received_events","type":"User","site_admin":false},"assignees":[{"login":"mbenadda","id":1932937,"node_id":"MDQ6VXNlcjE5MzI5Mzc=","avatar_url":"https://avatars0.githubusercontent.com/u/1932937?v=4","gravatar_id":"","url":"https://api.github.com/users/mbenadda","html_url":"https://github.com/mbenadda","followers_url":"https://api.github.com/users/mbenadda/followers","following_url":"https://api.github.com/users/mbenadda/following{/other_user}","gists_url":"https://api.github.com/users/mbenadda/gists{/gist_id}","starred_url":"https://api.github.com/users/mbenadda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbenadda/subscriptions","organizations_url":"https://api.github.com/users/mbenadda/orgs","repos_url":"https://api.github.com/users/mbenadda/repos","events_url":"https://api.github.com/users/mbenadda/events{/privacy}","received_events_url":"https://api.github.com/users/mbenadda/received_events","type":"User","site_admin":false}],"requested_reviewers":[{"login":"sampaccoud","id":1427165,"node_id":"MDQ6VXNlcjE0MjcxNjU=","avatar_url":"https://avatars3.githubusercontent.com/u/1427165?v=4","gravatar_id":"","url":"https://api.github.com/users/sampaccoud","html_url":"https://github.com/sampaccoud","followers_url":"https://api.github.com/users/sampaccoud/followers","following_url":"https://api.github.com/users/sampaccoud/following{/other_user}","gists_url":"https://api.github.com/users/sampaccoud/gists{/gist_id}","starred_url":"https://api.github.com/users/sampaccoud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sampaccoud/subscriptions","organizations_url":"https://api.github.com/users/sampaccoud/orgs","repos_url":"https://api.github.com/users/sampaccoud/repos","events_url":"https://api.github.com/users/sampaccoud/events{/privacy}","received_events_url":"https://api.github.com/users/sampaccoud/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[{"id":1064438747,"node_id":"MDU6TGFiZWwxMDY0NDM4NzQ3","url":"https://api.github.com/repos/openfun/marsha/labels/improvement","name":"improvement","color":"9900ff","default":false},{"id":1127694628,"node_id":"MDU6TGFiZWwxMTI3Njk0NjI4","url":"https://api.github.com/repos/openfun/marsha/labels/work%20in%20progress","name":"work in progress","color":"fbca04","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/openfun/marsha/pulls/144/commits","review_comments_url":"https://api.github.com/repos/openfun/marsha/pulls/144/comments","review_comment_url":"https://api.github.com/repos/openfun/marsha/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openfun/marsha/issues/144/comments","statuses_url":"https://api.github.com/repos/openfun/marsha/statuses/4609875295810b7e6bee159a0a064ef8843d96a6","head":{"label":"openfun:add-origin-checks-to-lti-video","ref":"add-origin-checks-to-lti-video","sha":"4609875295810b7e6bee159a0a064ef8843d96a6","user":{"login":"openfun","id":7224891,"node_id":"MDEyOk9yZ2FuaXphdGlvbjcyMjQ4OTE=","avatar_url":"https://avatars2.githubusercontent.com/u/7224891?v=4","gravatar_id":"","url":"https://api.github.com/users/openfun","html_url":"https://github.com/openfun","followers_url":"https://api.github.com/users/openfun/followers","following_url":"https://api.github.com/users/openfun/following{/other_user}","gists_url":"https://api.github.com/users/openfun/gists{/gist_id}","starred_url":"https://api.github.com/users/openfun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openfun/subscriptions","organizations_url":"https://api.github.com/users/openfun/orgs","repos_url":"https://api.github.com/users/openfun/repos","events_url":"https://api.github.com/users/openfun/events{/privacy}","received_events_url":"https://api.github.com/users/openfun/received_events","type":"Organization","site_admin":false},"repo":{"id":129740507,"node_id":"MDEwOlJlcG9zaXRvcnkxMjk3NDA1MDc=","name":"marsha","full_name":"openfun/marsha","private":false,"owner":{"login":"openfun","id":7224891,"node_id":"MDEyOk9yZ2FuaXphdGlvbjcyMjQ4OTE=","avatar_url":"https://avatars2.githubusercontent.com/u/7224891?v=4","gravatar_id":"","url":"https://api.github.com/users/openfun","html_url":"https://github.com/openfun","followers_url":"https://api.github.com/users/openfun/followers","following_url":"https://api.github.com/users/openfun/following{/other_user}","gists_url":"https://api.github.com/users/openfun/gists{/gist_id}","starred_url":"https://api.github.com/users/openfun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openfun/subscriptions","organizations_url":"https://api.github.com/users/openfun/orgs","repos_url":"https://api.github.com/users/openfun/repos","events_url":"https://api.github.com/users/openfun/events{/privacy}","received_events_url":"https://api.github.com/users/openfun/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/openfun/marsha","description":"🐠 A FUN LTI video provider","fork":false,"url":"https://api.github.com/repos/openfun/marsha","forks_url":"https://api.github.com/repos/openfun/marsha/forks","keys_url":"https://api.github.com/repos/openfun/marsha/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openfun/marsha/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openfun/marsha/teams","hooks_url":"https://api.github.com/repos/openfun/marsha/hooks","issue_events_url":"https://api.github.com/repos/openfun/marsha/issues/events{/number}","events_url":"https://api.github.com/repos/openfun/marsha/events","assignees_url":"https://api.github.com/repos/openfun/marsha/assignees{/user}","branches_url":"https://api.github.com/repos/openfun/marsha/branches{/branch}","tags_url":"https://api.github.com/repos/openfun/marsha/tags","blobs_url":"https://api.github.com/repos/openfun/marsha/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openfun/marsha/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openfun/marsha/git/refs{/sha}","trees_url":"https://api.github.com/repos/openfun/marsha/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openfun/marsha/statuses/{sha}","languages_url":"https://api.github.com/repos/openfun/marsha/languages","stargazers_url":"https://api.github.com/repos/openfun/marsha/stargazers","contributors_url":"https://api.github.com/repos/openfun/marsha/contributors","subscribers_url":"https://api.github.com/repos/openfun/marsha/subscribers","subscription_url":"https://api.github.com/repos/openfun/marsha/subscription","commits_url":"https://api.github.com/repos/openfun/marsha/commits{/sha}","git_commits_url":"https://api.github.com/repos/openfun/marsha/git/commits{/sha}","comments_url":"https://api.github.com/repos/openfun/marsha/comments{/number}","issue_comment_url":"https://api.github.com/repos/openfun/marsha/issues/comments{/number}","contents_url":"https://api.github.com/repos/openfun/marsha/contents/{+path}","compare_url":"https://api.github.com/repos/openfun/marsha/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openfun/marsha/merges","archive_url":"https://api.github.com/repos/openfun/marsha/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openfun/marsha/downloads","issues_url":"https://api.github.com/repos/openfun/marsha/issues{/number}","pulls_url":"https://api.github.com/repos/openfun/marsha/pulls{/number}","milestones_url":"https://api.github.com/repos/openfun/marsha/milestones{/number}","notifications_url":"https://api.github.com/repos/openfun/marsha/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openfun/marsha/labels{/name}","releases_url":"https://api.github.com/repos/openfun/marsha/releases{/id}","deployments_url":"https://api.github.com/repos/openfun/marsha/deployments","created_at":"2018-04-16T12:32:54Z","updated_at":"2018-11-13T13:43:06Z","pushed_at":"2018-11-15T15:00:49Z","git_url":"git://github.com/openfun/marsha.git","ssh_url":"git@github.com:openfun/marsha.git","clone_url":"https://github.com/openfun/marsha.git","svn_url":"https://github.com/openfun/marsha","homepage":"","size":585,"stargazers_count":4,"watchers_count":4,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"archived":false,"open_issues_count":10,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":1,"open_issues":10,"watchers":4,"default_branch":"master"}},"base":{"label":"openfun:master","ref":"master","sha":"7cfcb2c24c6cbf486f395cdf17e3c2be75e706e7","user":{"login":"openfun","id":7224891,"node_id":"MDEyOk9yZ2FuaXphdGlvbjcyMjQ4OTE=","avatar_url":"https://avatars2.githubusercontent.com/u/7224891?v=4","gravatar_id":"","url":"https://api.github.com/users/openfun","html_url":"https://github.com/openfun","followers_url":"https://api.github.com/users/openfun/followers","following_url":"https://api.github.com/users/openfun/following{/other_user}","gists_url":"https://api.github.com/users/openfun/gists{/gist_id}","starred_url":"https://api.github.com/users/openfun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openfun/subscriptions","organizations_url":"https://api.github.com/users/openfun/orgs","repos_url":"https://api.github.com/users/openfun/repos","events_url":"https://api.github.com/users/openfun/events{/privacy}","received_events_url":"https://api.github.com/users/openfun/received_events","type":"Organization","site_admin":false},"repo":{"id":129740507,"node_id":"MDEwOlJlcG9zaXRvcnkxMjk3NDA1MDc=","name":"marsha","full_name":"openfun/marsha","private":false,"owner":{"login":"openfun","id":7224891,"node_id":"MDEyOk9yZ2FuaXphdGlvbjcyMjQ4OTE=","avatar_url":"https://avatars2.githubusercontent.com/u/7224891?v=4","gravatar_id":"","url":"https://api.github.com/users/openfun","html_url":"https://github.com/openfun","followers_url":"https://api.github.com/users/openfun/followers","following_url":"https://api.github.com/users/openfun/following{/other_user}","gists_url":"https://api.github.com/users/openfun/gists{/gist_id}","starred_url":"https://api.github.com/users/openfun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openfun/subscriptions","organizations_url":"https://api.github.com/users/openfun/orgs","repos_url":"https://api.github.com/users/openfun/repos","events_url":"https://api.github.com/users/openfun/events{/privacy}","received_events_url":"https://api.github.com/users/openfun/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/openfun/marsha","description":"🐠 A FUN LTI video provider","fork":false,"url":"https://api.github.com/repos/openfun/marsha","forks_url":"https://api.github.com/repos/openfun/marsha/forks","keys_url":"https://api.github.com/repos/openfun/marsha/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openfun/marsha/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openfun/marsha/teams","hooks_url":"https://api.github.com/repos/openfun/marsha/hooks","issue_events_url":"https://api.github.com/repos/openfun/marsha/issues/events{/number}","events_url":"https://api.github.com/repos/openfun/marsha/events","assignees_url":"https://api.github.com/repos/openfun/marsha/assignees{/user}","branches_url":"https://api.github.com/repos/openfun/marsha/branches{/branch}","tags_url":"https://api.github.com/repos/openfun/marsha/tags","blobs_url":"https://api.github.com/repos/openfun/marsha/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openfun/marsha/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openfun/marsha/git/refs{/sha}","trees_url":"https://api.github.com/repos/openfun/marsha/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openfun/marsha/statuses/{sha}","languages_url":"https://api.github.com/repos/openfun/marsha/languages","stargazers_url":"https://api.github.com/repos/openfun/marsha/stargazers","contributors_url":"https://api.github.com/repos/openfun/marsha/contributors","subscribers_url":"https://api.github.com/repos/openfun/marsha/subscribers","subscription_url":"https://api.github.com/repos/openfun/marsha/subscription","commits_url":"https://api.github.com/repos/openfun/marsha/commits{/sha}","git_commits_url":"https://api.github.com/repos/openfun/marsha/git/commits{/sha}","comments_url":"https://api.github.com/repos/openfun/marsha/comments{/number}","issue_comment_url":"https://api.github.com/repos/openfun/marsha/issues/comments{/number}","contents_url":"https://api.github.com/repos/openfun/marsha/contents/{+path}","compare_url":"https://api.github.com/repos/openfun/marsha/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openfun/marsha/merges","archive_url":"https://api.github.com/repos/openfun/marsha/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openfun/marsha/downloads","issues_url":"https://api.github.com/repos/openfun/marsha/issues{/number}","pulls_url":"https://api.github.com/repos/openfun/marsha/pulls{/number}","milestones_url":"https://api.github.com/repos/openfun/marsha/milestones{/number}","notifications_url":"https://api.github.com/repos/openfun/marsha/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openfun/marsha/labels{/name}","releases_url":"https://api.github.com/repos/openfun/marsha/releases{/id}","deployments_url":"https://api.github.com/repos/openfun/marsha/deployments","created_at":"2018-04-16T12:32:54Z","updated_at":"2018-11-13T13:43:06Z","pushed_at":"2018-11-15T15:00:49Z","git_url":"git://github.com/openfun/marsha.git","ssh_url":"git@github.com:openfun/marsha.git","clone_url":"https://github.com/openfun/marsha.git","svn_url":"https://github.com/openfun/marsha","homepage":"","size":585,"stargazers_count":4,"watchers_count":4,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"archived":false,"open_issues_count":10,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":1,"open_issues":10,"watchers":4,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openfun/marsha/pulls/144"},"html":{"href":"https://github.com/openfun/marsha/pull/144"},"issue":{"href":"https://api.github.com/repos/openfun/marsha/issues/144"},"comments":{"href":"https://api.github.com/repos/openfun/marsha/issues/144/comments"},"review_comments":{"href":"https://api.github.com/repos/openfun/marsha/pulls/144/comments"},"review_comment":{"href":"https://api.github.com/repos/openfun/marsha/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openfun/marsha/pulls/144/commits"},"statuses":{"href":"https://api.github.com/repos/openfun/marsha/statuses/4609875295810b7e6bee159a0a064ef8843d96a6"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"sampaccoud"}}