mirrors
/
gotosocial
mirror of
1
Fork 0
Code Issues Releases Activity

[bugfix] Convert IDNs to punycode before using as session name (#458) 

* convert hostname to punycode for session name

* test punycode
This commit is contained in:
tobi 2022-04-16 13:09:42 +02:00 committed by GitHub
parent af97d6bb7e
commit 7883dd5499
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
internal/router/session.go
View File

@ -31,6 +31,7 @@ import (
"github.com/spf13/viper"
"github.com/superseriousbusiness/gotosocial/internal/config"
"github.com/superseriousbusiness/gotosocial/internal/db"
"golang.org/x/net/idna"
)
// SessionOptions returns the standard set of options to use for each session.
@ -61,7 +62,14 @@ func SessionName() (string, error) {
return "", fmt.Errorf("could not derive hostname without port from %s://%s", protocol, host)
}
return fmt.Sprintf("gotosocial-%s", strippedHostname), nil
// make sure IDNs are converted to punycode or the cookie library breaks:
// see https://en.wikipedia.org/wiki/Punycode
punyHostname, err := idna.New().ToASCII(strippedHostname)
if err != nil {
return "", fmt.Errorf("could not convert %s to punycode: %s", strippedHostname, err)
}
return fmt.Sprintf("gotosocial-%s", punyHostname), nil
}
func useSession(ctx context.Context, sessionDB db.Session, engine *gin.Engine) error {

9
internal/router/session_test.go
View File

@ -82,6 +82,15 @@ func (suite *SessionTestSuite) TestDeriveSessionOK() {
suite.Equal("gotosocial-example.org", sessionName)
}
func (suite *SessionTestSuite) TestDeriveSessionIDNOK() {
viper.Set(config.Keys.Protocol, "https")
viper.Set(config.Keys.Host, "fóid.org")
sessionName, err := router.SessionName()
suite.NoError(err)
suite.Equal("gotosocial-xn--fid-gna.org", sessionName)
}
func TestSessionTestSuite(t *testing.T) {
suite.Run(t, &SessionTestSuite{})
}