{"action":"created","issue":{"url":"https://api.github.com/repos/codice/ddf/issues/3297","repository_url":"https://api.github.com/repos/codice/ddf","labels_url":"https://api.github.com/repos/codice/ddf/issues/3297/labels{/name}","comments_url":"https://api.github.com/repos/codice/ddf/issues/3297/comments","events_url":"https://api.github.com/repos/codice/ddf/issues/3297/events","html_url":"https://github.com/codice/ddf/pull/3297","id":329902672,"node_id":"MDExOlB1bGxSZXF1ZXN0MTkzMDQwMjQ2","number":3297,"title":"DDF-3855: Add CSRF Protections to Jolokia and Intrigue Endpoints","user":{"login":"garrettfreibott","id":12499654,"node_id":"MDQ6VXNlcjEyNDk5NjU0","avatar_url":"https://avatars1.githubusercontent.com/u/12499654?v=4","gravatar_id":"","url":"https://api.github.com/users/garrettfreibott","html_url":"https://github.com/garrettfreibott","followers_url":"https://api.github.com/users/garrettfreibott/followers","following_url":"https://api.github.com/users/garrettfreibott/following{/other_user}","gists_url":"https://api.github.com/users/garrettfreibott/gists{/gist_id}","starred_url":"https://api.github.com/users/garrettfreibott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garrettfreibott/subscriptions","organizations_url":"https://api.github.com/users/garrettfreibott/orgs","repos_url":"https://api.github.com/users/garrettfreibott/repos","events_url":"https://api.github.com/users/garrettfreibott/events{/privacy}","received_events_url":"https://api.github.com/users/garrettfreibott/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/codice/ddf/milestones/12","html_url":"https://github.com/codice/ddf/milestone/12","labels_url":"https://api.github.com/repos/codice/ddf/milestones/12/labels","id":2734324,"node_id":"MDk6TWlsZXN0b25lMjczNDMyNA==","number":12,"title":"2.12","description":"","creator":{"login":"shaundmorris","id":4359166,"node_id":"MDQ6VXNlcjQzNTkxNjY=","avatar_url":"https://avatars3.githubusercontent.com/u/4359166?v=4","gravatar_id":"","url":"https://api.github.com/users/shaundmorris","html_url":"https://github.com/shaundmorris","followers_url":"https://api.github.com/users/shaundmorris/followers","following_url":"https://api.github.com/users/shaundmorris/following{/other_user}","gists_url":"https://api.github.com/users/shaundmorris/gists{/gist_id}","starred_url":"https://api.github.com/users/shaundmorris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shaundmorris/subscriptions","organizations_url":"https://api.github.com/users/shaundmorris/orgs","repos_url":"https://api.github.com/users/shaundmorris/repos","events_url":"https://api.github.com/users/shaundmorris/events{/privacy}","received_events_url":"https://api.github.com/users/shaundmorris/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":30,"state":"open","created_at":"2017-08-30T21:55:06Z","updated_at":"2018-06-13T15:55:16Z","due_on":null,"closed_at":null},"comments":30,"created_at":"2018-06-06T14:50:12Z","updated_at":"2018-06-13T15:55:28Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/codice/ddf/pulls/3297","html_url":"https://github.com/codice/ddf/pull/3297","diff_url":"https://github.com/codice/ddf/pull/3297.diff","patch_url":"https://github.com/codice/ddf/pull/3297.patch"},"body":"#### What does this PR do?\r\nAdds the header \"X-Requested-With\" as a required header on the backend so that all incoming requests to anything under `/admin/jolokia` or `/search/catalog/internal` must contain this header or a 403 will be returned. Value of this header can be anything, only it's presence is checked. The incoming request must also have either an origin or referer header that matches the target origin or a 403 will be returned. Also adds this header to any necessary UI packages.\r\n\r\n#### Who is reviewing it? \r\n@djblue \r\n@rzwiefel \r\n@tbatie \r\n\r\n#### Select relevant component teams: \r\n@codice/security \r\n@codice/ui \r\n\r\n#### Ask 2 committers to review/merge the PR and tag them here. If you don't know who to ask, \r\n@andrewkfiedler \r\n@stustison\r\n\r\n#### How should this be tested?\r\nMake sure the admin UI and Intrigue still work. Watch network requests and make sure no 403s are returned. Try accessing jolokia & intrigue internal URLs directly and ensure that they cannot be accessed - a 403 should be returned. See below for a list of packages and contexts that make jolokia and intrigue contexts that should be checked for compatibility.\r\n\r\n#### Any background context you want to provide?\r\nCurrently holding out on merging this PR while downstream Codice project frontends are checked and modified to ensure compatibility with this new requirement.\r\n\r\nThe following UI packages under `/ui/packages` make jolokia or intrigue calls and were checked for functionality to ensure that the header was being attached to any outgoing jolokia requests:\r\n`jQuery-updated` ui - /admin\r\n`ok` spatial-geocoding-admin-module - /admin/spatial-config\r\n`ok` resourcemanagement-usage-ui - /admin/data-usage\r\n`ok` resourcemanagement-querymonitor-ui - /admin/queries\r\n`ok` registry-admin-remote-ui - /admin/registry/remote\r\n`ok` registry-admin-local-ui - /admin/registry/local\r\n`ok` catalog-admin-module-sources - /admin/sources\r\n`fetch-updated` catalog-admin-module-maplayers - /admin/map-layers\r\n`fetch-updated` catalog-admin-module-layout - /admin/default-layout\r\n`fetch-updated` broker-undelivered-messages-ui - /admin/undeliveredMessages\r\n`ok` admin-security-certificate-ui - /admin/certificate\r\n`used in test-only` admin-metrics-ui - /admin/metrics\r\n`fetch-updated` admin-core-logviewer - /admin/logviewer\r\n\r\n#### What are the relevant tickets?\r\nhttps://codice.atlassian.net/browse/DDF-3855\r\n\r\n#### Screenshots (if appropriate)\r\n#### Checklist:\r\n- [x] Documentation Updated\r\n- [X] Update / Add Unit Tests\r\n- [x] Update / Add Integration Tests\r\n\r\n#### Notes on Review Process\r\nPlease see [Notes on Review Process](https://codice.atlassian.net/wiki/spaces/DDF/pages/71946981/Pull+Request+Guidelines) for further guidance on requirements for merging and abbreviated reviews. \r\n\r\n#### Review Comment Legend:\r\n- ✏️ (Pencil) This comment is a nitpick or style suggestion, no action required for approval. This comment should provide a suggestion either as an in line code snippet or a gist. \r\n- ❓ (Question Mark) This comment is to gain a clearer understanding of design or code choices, clarification is required but action may not be necessary for approval.\r\n- ❗ (Exclamation Mark) This comment is critical and requires clarification or action before approval.\r\n"},"comment":{"url":"https://api.github.com/repos/codice/ddf/issues/comments/396990158","html_url":"https://github.com/codice/ddf/pull/3297#issuecomment-396990158","issue_url":"https://api.github.com/repos/codice/ddf/issues/3297","id":396990158,"node_id":"MDEyOklzc3VlQ29tbWVudDM5Njk5MDE1OA==","user":{"login":"cxbot","id":21088360,"node_id":"MDQ6VXNlcjIxMDg4MzYw","avatar_url":"https://avatars2.githubusercontent.com/u/21088360?v=4","gravatar_id":"","url":"https://api.github.com/users/cxbot","html_url":"https://github.com/cxbot","followers_url":"https://api.github.com/users/cxbot/followers","following_url":"https://api.github.com/users/cxbot/following{/other_user}","gists_url":"https://api.github.com/users/cxbot/gists{/gist_id}","starred_url":"https://api.github.com/users/cxbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cxbot/subscriptions","organizations_url":"https://api.github.com/users/cxbot/orgs","repos_url":"https://api.github.com/users/cxbot/repos","events_url":"https://api.github.com/users/cxbot/events{/privacy}","received_events_url":"https://api.github.com/users/cxbot/received_events","type":"User","site_admin":false},"created_at":"2018-06-13T15:55:28Z","updated_at":"2018-06-13T15:55:28Z","author_association":"COLLABORATOR","body":"\nRefer to this link for build results (access rights to CI server needed): \nhttps://jenkins.codice.org/job/DDF-Jobs/job/pr/job/Linux/4365/<h2>Build result: FAILURE</span></h2>[...truncated 4.45 MB...]\tat org.apache.commons.exec.DefaultExecutor.executeInternal(DefaultExecutor.java:404)\tat org.apache.commons.exec.DefaultExecutor.execute(DefaultExecutor.java:166)\tat com.github.eirslett.maven.plugins.frontend.lib.ProcessExecutor.execute(ProcessExecutor.java:84)\t... 38 more[ERROR] [ERROR] Re-run Maven using the -X switch to enable full debug logging.[ERROR] [ERROR] For more information about the errors and possible solutions, please read the following articles:[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException[ERROR] [ERROR] After correcting the problems, you can resume the build with the command[ERROR]   mvn <goals> -rf :uiSet build name.channel stoppedNew build name is 'PR 3297'Taking single-use slave mesos-jenkins-f05764738de44783ba4c46d96a626e4e-linux-large offline.Archiving artifacts[BFA] Scanning build for known causes...[BFA] No failure causes found[BFA] Done. 6sAdding one-line test results to commit status...Setting status of f43449f777fff8161d08ff60dcaea6660aaa8e86 to FAILURE with url https://jenkins.codice.org/job/DDF-Jobs/job/pr/job/Linux/4365/ and message: 'JOB FAILURE: https://jenkins.codice.org/job/DDF-Jobs/job/pr/job/Linux/4365/ 244 tests run, 2 skipped, 0 failed.'Using context: Internal CI Pipeline\n:x: JOB FAILURE\n"}}
{"actor":{"display_login":"cxbot"}}