Skip to content

G
go-ipfs
切换分支/标签
  1. 12 4月, 2016 8 次提交
  3. 11 4月, 2016 3 次提交
  5. 08 4月, 2016 14 次提交
  7. 07 4月, 2016 11 次提交
  9. 05 4月, 2016 1 次提交
  11. 04 4月, 2016 3 次提交
    • Merge pull request #1988 from ipfs/ipfs-prefix-hardening · c6e6bb05 
      gateway: harden path prefix
      由 Jeromy Johnson 提交于
    • gateway: enforce allowlist for path prefixes · 09937f84 
      The gateway accepts an X-Ipfs-Path-Prefix header,
and assumes that it is mounted in a reverse proxy
like nginx, at this path. Links in directory listings,
as well as trailing-slash redirects need to be rewritten
with that prefix in mind.

We don't want a potential attacker to be able to
pass in arbitrary path prefixes, which would end up
in redirects and directory listings, which is why
every prefix has to be explicitly allowed in the config.

Previously, we'd accept *any* X-Ipfs-Path-Prefix header.

Example:

We mount blog.ipfs.io (a dnslink page) at ipfs.io/blog.

nginx_ipfs.conf:

    location /blog/ {
        rewrite "^/blog(/.*)$" $1 break;
        proxy_set_header Host blog.ipfs.io;
        proxy_set_header X-Ipfs-Gateway-Prefix /blog;
        proxy_pass http://127.0.0.1:8080;
    }

.ipfs/config:

    "Gateway": {
        "PathPrefixes": ["/blog"],
        // ...
    },

dnslink:

    > dig TXT _dnslink.blog.ipfs.io
    dnslink=/ipfs/QmWcBjXPAEdhXDATV4ghUpkAonNBbiyFx1VmmHcQe9HEGd

License: MIT
Signed-off-by: 's avatarLars Gierth <larsg@systemli.org>
      由 Lars Gierth 提交于
    • datafieldenc switch statement · bd5e08ca 
      License: MIT
Signed-off-by: 's avatarslothbag <slothbag@gmail.com>
      由 slothbag 提交于