resque 3.1.0 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 47f174d6353bf3747da1ec6189f5b405717399418b421c8b071b3fa806869355
-  data.tar.gz: 573d98cd9d90a504bf1eb79e8d93b0fcd59d67bc36adc5126cbb144304e03bc3
+  metadata.gz: be22244b12745d8c64f2457316c3333e4a9c3da135e24106a936c8e033b897f6
+  data.tar.gz: e781358b1a1b0170c20ed7a02ca5612d2d9d03d12f093b2fa6ee2307e359651e
 SHA512:
-  metadata.gz: 265e97433c7e8eb1d5fcaafad19f4505fabca6580e9e727a07f1e281a7af310ddae15b6721452cd7064249f55dcdf1bfa3967ea3823b8f1c436eee91c15bb917
-  data.tar.gz: 9bce6a28a4ee107fc1f347ac92b7b885823d67a2b725fd0152ea2ad7e9b34a6003884e35330f4876a9bddf854aaa46bbec096db1766e5d653b6572b4b0f99ec9
+  metadata.gz: f57a83bed2a763e8cab29b6dcefed7dce1786e200a47c24ac43b76f0d894a0b99ff8954b67c1b37b77e675042f769fd0c3dbb0e0676b228ac30dedb65fa7d3e6
+  data.tar.gz: 482d1cb41507ea69c143761286135102339d3070fd32374d140bcf73a8b253f6f9627f2fe2027a1707b44a7f0e36ed2ac34acbab62ab7505f7fb790efcec8923

data/HISTORY.md

@@ -1,3 +1,9 @@
+## 3.2.0
+
+### Security
+
+* resque-web: Reject cross-site non-GET requests, and make single failed-job retry and remove POST-only (#1980)
+
 ## 3.1.0
 
 ### Breaking Changes

data/lib/resque/server/public/ranger.js

@@ -102,11 +102,11 @@ $(function() {
     $(this).removeClass('hover');
   })
 
-  $('ul.failed a[rel=retry]').click(function() {
-    var href = $(this).attr('href');
-    $(this).text('Retrying...');
+  $('ul.failed form.retry').submit(function() {
+    var href = $(this).attr('action');
+    $('input', this).val('Retrying...');
     var parent = $(this).parent();
-    $.ajax({dataType: 'text', type: 'get', url: href, success: function(data) {
+    $.ajax({dataType: 'text', type: 'post', url: href, success: function(data) {
       parent.html('Retried <b><span class="time">' + data + '</span></b>');
       relatizer.apply($('.time', parent));
       $('.date_time', parent).hide();

data/lib/resque/server/public/style.css

@@ -157,6 +157,7 @@ body { padding:0; margin:0; }
 #main ul.failed li.hover dl dd .retried .remove { display:block; }
 #main ul.failed li dl dd .controls { display:none; float:right; }
 #main ul.failed li.hover dl dd .controls { display:block; }
+#main ul.failed li dl dd form { float:none; margin:0; display:inline; }
 #main ul.failed li dl dd code, #main ul.failed li dl dd pre { font-family:Monaco, "Courier New", monospace; font-size:90%; white-space: pre-wrap; color: var(--text-primary);}
 #main ul.failed li dl dd.error a {font-family:Monaco, "Courier New", monospace; font-size:90%; }
 #main ul.failed li dl dd.error pre { margin-top:3px; line-height:1.3;}

data/lib/resque/server/views/failed_job.erb

@@ -10,13 +10,18 @@
       <% if job['retried_at'] %>
         <div class='retried'>
           Retried <b><span class="time"><%= DateTime.parse(job['retried_at']).strftime(failed_date_format) %></span></b>
-          <a href="<%= h u("#{queue}/remove/#{id}") %>" class="remove" rel="remove">Remove</a>
+          <form method="POST" action="<%= h u("#{queue}/remove/#{id}") %>" class="remove">
+            <input type="submit" name="" value="Remove" />
+          </form>
         </div>
       <% else %>
         <div class='controls'>
-          <a href="<%= h u("#{queue}/requeue/#{id}") %>" rel="retry">Retry</a>
-          or
-          <a href="<%= h u("#{queue}/remove/#{id}") %>" rel="remove">Remove</a>
+          <form method="POST" action="<%= h u("#{queue}/requeue/#{id}") %>" class="retry">
+            <input type="submit" name="" value="Retry" />
+          </form>
+          <form method="POST" action="<%= h u("#{queue}/remove/#{id}") %>">
+            <input type="submit" name="" value="Remove" />
+          </form>
         </div>
       <% end %>
     </dd>

data/lib/resque/server.rb

@@ -28,6 +28,20 @@ module Resque
       include Resque::ServerHelper
     end
 
+    before do
+      halt 403, 'Cross-site request rejected' if !request.safe? && cross_site_request?
+    end
+
+    def cross_site_request?
+      if (fetch_site = request.env['HTTP_SEC_FETCH_SITE'])
+        !%w[same-origin none].include?(fetch_site)
+      elsif (origin = request.env['HTTP_ORIGIN'])
+        origin.sub(%r{\A[a-z][a-z0-9+.-]*://}i, '') != request.host_with_port
+      else
+        false
+      end
+    end
+
     def show(page, layout = true)
       response["Cache-Control"] = "max-age=0, private, must-revalidate"
       begin
@@ -129,7 +143,7 @@ module Resque
       redirect url_path("/failed/#{params[:queue]}")
     end
 
-    get "/failed/requeue/:index/?" do
+    post "/failed/requeue/:index/?" do
       Resque::Failure.requeue(params[:index])
       if request.xhr?
         return Resque::Failure.all(params[:index])['retried_at']
@@ -138,7 +152,7 @@ module Resque
       end
     end
 
-    get "/failed/:queue/requeue/:index/?" do
+    post "/failed/:queue/requeue/:index/?" do
       Resque::Failure.requeue(params[:index], params[:queue])
       if request.xhr?
         return Resque::Failure.all(params[:index],1,params[:queue])['retried_at']
@@ -147,12 +161,12 @@ module Resque
       end
     end
 
-    get "/failed/remove/:index/?" do
+    post "/failed/remove/:index/?" do
       Resque::Failure.remove(params[:index])
       redirect u('failed')
     end
 
-    get "/failed/:queue/remove/:index/?" do
+    post "/failed/:queue/remove/:index/?" do
       Resque::Failure.remove(params[:index], params[:queue])
       redirect url_path("/failed/#{params[:queue]}")
     end

data/lib/resque/version.rb

@@ -1,3 +1,3 @@
 module Resque
-  VERSION = '3.1.0'
+  VERSION = '3.2.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: resque
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.2.0
 platform: ruby
 authors:
 - Chris Wanstrath