Repository navigation
Conversation
runFunc, the handler for /_ah/queue/go/delay, gob-decodes the request body and calls whichever registered function it names with the decoded arguments. Nothing checks that the request was dispatched by the Task Queue service, and the package documentation explicitly allows the path to have no access restriction in app.yaml. On such an app any external client can POST a forged invocation and run any delay.Func with arguments of its choosing. App Engine strips X-AppEngine-* headers from requests that come from outside, so require X-AppEngine-QueueName and answer 403 without decoding the body when it is missing. The Python deferred handler makes the same check on X-AppEngine-TaskName. Update the existing tests to send the header the Task Queue service sets, and add a test that a request without it does not run the function.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reproducer, POSTing a registered function's payload without any task queue headers:
runFuncgob-decodes the body of any request to/_ah/queue/go/delayand calls the registered function it names with the decoded arguments. The package doc allows that path to have no access restriction in app.yaml, so on such an app anyone can invoke anydelay.Funcwith arguments of their choosing. App Engine stripsX-AppEngine-*headers from external requests, so the handler now requiresX-AppEngine-QueueNameand returns 403 otherwise, the same check the Pythondeferredhandler does withX-AppEngine-TaskName. Applied to both modules; existing tests now send the header.