mirror of
https://github.com/Donkie/Spoolman.git
synced 2026-10-19 00:29:46 -05:00
Donkie
97524b1107
Closes the DNS rebinding hole, which the origin guard structurally cannot: under rebinding the attacker's page keeps its own name, so Origin and Host agree with each other and the origin guard trusts them both, while the address behind that name is the victim's Spoolman instance. The default allows everything a stranger cannot point at someone else's machine -- any IP literal, any single-label name, and the non-registrable suffixes -- because what the attack needs is a registrable public domain. That leaves a reverse proxy on a real domain, which cannot be told apart from the attack and so must declare itself via SPOOLMAN_ALLOWED_HOSTS.
39 lines
1.0 KiB
YAML
39 lines
1.0 KiB
YAML
version: '3.8'
|
|
services:
|
|
db:
|
|
image: postgres:11-alpine
|
|
environment:
|
|
- POSTGRES_PASSWORD=abc
|
|
- TZ='GMT+4'
|
|
- PGTZ='GMT+4'
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres"]
|
|
interval: 1s
|
|
timeout: 5s
|
|
retries: 30
|
|
spoolman:
|
|
image: donkie/spoolman:test
|
|
environment:
|
|
- SPOOLMAN_DB_TYPE=postgres
|
|
- SPOOLMAN_DB_HOST=db
|
|
- SPOOLMAN_DB_PORT=5432
|
|
- SPOOLMAN_DB_NAME=postgres
|
|
- SPOOLMAN_DB_USERNAME=postgres
|
|
- SPOOLMAN_DB_PASSWORD=abc
|
|
- SPOOLMAN_LOGGING_LEVEL=INFO
|
|
# The host guard refuses public domain names it was not told about; the security
|
|
# tests need one that is allowed as well as one that is not.
|
|
- SPOOLMAN_ALLOWED_HOSTS=spoolman.example.com
|
|
- TZ=Europe/Stockholm
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
tester:
|
|
image: donkie/spoolman-tester:latest
|
|
volumes:
|
|
- ./tests:/tester/tests
|
|
environment:
|
|
- DB_TYPE=postgres
|
|
depends_on:
|
|
- spoolman
|