Skip to content

GitLab

funkwhale
funkwhale
Closed
Opened by Agate@eliotberriot💬Owner
Report abuse New issue

Ensure we are not vulnerable to BREACH attack

My understanding is that we need all of the following conditions to be true for the attack to be an issue:

  1. Response body contains sensitive information an attacker may want to guess
  2. Response body contains a user given string (such as a search param)
  3. HTTP compression is on

Since Funkwhale is an SPA, most of the UI is made of static content. Item 1 is not checked for this resources and we should be able to keep HTTP compression on.

Now, Funkwhale API do contain sensitive data. However, I cannot think of any endpoint that includes sensitive data (1) and user input (such as a search param) in response body. I have to admit this could change in the future though.

Django's admin (/api/admin) is a much more traditionnal web app and may be vulnerable though, since it contains lots of sensitive data (although CSRF were secured with https://code.djangoproject.com/ticket/20869), and possible user input (via search params).

Suggested mitigation:

  • Disable HTTP compression for json content
  • Disable HTTP compression for admin urls

If anyone wants to give feedback advice on this, you're welcome :)

Links: