{"action":"created","issue":{"url":"https://api.github.com/repos/shikimori/shikimori/issues/1732","repository_url":"https://api.github.com/repos/shikimori/shikimori","labels_url":"https://api.github.com/repos/shikimori/shikimori/issues/1732/labels{/name}","comments_url":"https://api.github.com/repos/shikimori/shikimori/issues/1732/comments","events_url":"https://api.github.com/repos/shikimori/shikimori/issues/1732/events","html_url":"https://github.com/shikimori/shikimori/issues/1732","id":470715869,"node_id":"MDU6SXNzdWU0NzA3MTU4Njk=","number":1732,"title":"CSRF","user":{"login":"RikaDesu","id":53127914,"node_id":"MDQ6VXNlcjUzMTI3OTE0","avatar_url":"https://avatars2.githubusercontent.com/u/53127914?v=4","gravatar_id":"","url":"https://api.github.com/users/RikaDesu","html_url":"https://github.com/RikaDesu","followers_url":"https://api.github.com/users/RikaDesu/followers","following_url":"https://api.github.com/users/RikaDesu/following{/other_user}","gists_url":"https://api.github.com/users/RikaDesu/gists{/gist_id}","starred_url":"https://api.github.com/users/RikaDesu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RikaDesu/subscriptions","organizations_url":"https://api.github.com/users/RikaDesu/orgs","repos_url":"https://api.github.com/users/RikaDesu/repos","events_url":"https://api.github.com/users/RikaDesu/events{/privacy}","received_events_url":"https://api.github.com/users/RikaDesu/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-07-20T21:24:55Z","updated_at":"2019-08-01T14:38:37Z","closed_at":"2019-08-01T14:38:37Z","author_association":"NONE","body":"Currently public API can be accessed without oauth if user is logged in to the site (i.e. `_kawai_session` cookie is set) from any origin. API supports JSONP (idk whether this is intentional), so user data can be leaked to any 3rd party. Even though only `GET` endpoints may be accessed, user's private info like lists may get leaked easily.\r\n\r\n### Steps to reproduce\r\n1. Log in on the site\r\n2. Visit any third party site without `script-src` CSP directive (e.g. [google.com](//google.com))\r\n3. Open devtools and make a JSONP request:\r\n```js\r\nvar script = document.createElement('script')\r\nscript.src = 'https://shikimori.one/api/users/whoami?callback=console.log'\r\ndocument.head.appendChild(script)\r\n```\r\n### Expected behaviour\r\nAPI returns `Unauthorized` error\r\n\r\n### Actual behaviour\r\nAPI returns currently logged in user's info.\r\n\r\n### Possible fixes\r\n - ignore user's cookie at all times or only if `Referer` header is set and is not shikimori's one\r\n - remove JSONP support\r\n - use `Same-Site` flag for `_kawai_session` cookie"},"comment":{"url":"https://api.github.com/repos/shikimori/shikimori/issues/comments/517316203","html_url":"https://github.com/shikimori/shikimori/issues/1732#issuecomment-517316203","issue_url":"https://api.github.com/repos/shikimori/shikimori/issues/1732","id":517316203,"node_id":"MDEyOklzc3VlQ29tbWVudDUxNzMxNjIwMw==","user":{"login":"RikaDesu","id":53127914,"node_id":"MDQ6VXNlcjUzMTI3OTE0","avatar_url":"https://avatars2.githubusercontent.com/u/53127914?v=4","gravatar_id":"","url":"https://api.github.com/users/RikaDesu","html_url":"https://github.com/RikaDesu","followers_url":"https://api.github.com/users/RikaDesu/followers","following_url":"https://api.github.com/users/RikaDesu/following{/other_user}","gists_url":"https://api.github.com/users/RikaDesu/gists{/gist_id}","starred_url":"https://api.github.com/users/RikaDesu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RikaDesu/subscriptions","organizations_url":"https://api.github.com/users/RikaDesu/orgs","repos_url":"https://api.github.com/users/RikaDesu/repos","events_url":"https://api.github.com/users/RikaDesu/events{/privacy}","received_events_url":"https://api.github.com/users/RikaDesu/received_events","type":"User","site_admin":false},"created_at":"2019-08-01T14:38:37Z","updated_at":"2019-08-01T14:38:37Z","author_association":"NONE","body":"Seems to be closed by [09d94e6](https://github.com/shikimori/shikimori/commit/09d94e68bb67543ad7c55c8eb6b628fe449dd419)"}}
{"actor":{"display_login":"RikaDesu"}}