ylqjgm
/
canvas-lms
mirror of https://github.com/instructure/canvas-lms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
canvas-lms/gems/canvas_breach_mitigation
History
Cody Cutrer bc3a49a39b bundle update rspec-support 
Change-Id: I6027df59b78db2aaba06c30aef8d7fb25dcc5f24
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/341539
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Aaron Ogata <aogata@instructure.com>
Build-Review: Aaron Ogata <aogata@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
 		2024-03-01 22:27:40 +00:00
..
lib RuboCop: Style/StringLiterals, Style/StringLiteralsInInterpolation 2021-11-25 14:03:06 +00:00
spec rubocop: prep for updating rubocop-rspec 2023-04-12 19:30:10 +00:00
.rspec raise bundler minimum requirement 2021-02-19 22:49:02 +00:00
Gemfile add Rails 7.1 lockfiles for embedded gems 2024-02-14 22:30:10 +00:00
Gemfile.lock bundle update rspec-support 2024-03-01 22:27:40 +00:00
Gemfile.rails71.lock bundle update rspec-support 2024-03-01 22:27:40 +00:00
LICENSE.txt da licença part 53 2017-05-01 21:06:11 +00:00
README.md convert breach migration plugin to proper gem and fix name 2014-01-30 22:55:31 +00:00
canvas_breach_mitigation.gemspec fix lockfile syncing from canvas lockfile to sub-gems 2023-05-09 22:57:42 +00:00
test.sh simplify gem test harnesses 2016-01-19 17:52:58 +00:00

README.md

Canvas Breach Mitigation

This is a fork of the breach-mitigation-rails gem: http://rubygems.org/gems/breach-mitigation-rails

TODO: Ideally this should be replaced with the gem

Makes Rails applications less susceptible to the BREACH / CRIME attacks. See breachattack.com for details.

How it works

This implements one of the suggestion mitigation strategies from the paper:

Masking Secrets: The Rails CSRF token is 'masked' by encrypting it with a 32-byte one-time pad, and the pad and encrypted token are returned to the browser, instead of the "real" CSRF token. This only protects the CSRF token from an attacker; it does not protect other data on your pages (see the paper for details on this).

Warning!

BREACH and CRIME are complicated and wide-ranging attacks, and this gem offers only partial protection for Rails applications. If you're concerned about the security of your web app, you should review the BREACH paper and look for other, application-specific things you can do to prevent or mitigate this class of attacks.

Gotchas

  • If you have overridden the verified_request? method in your application (likely in ApplicationController) you may need to update it to be compatible with the secret masking code.