dps: Forbid users to specify their own headers

tkuester · Apr 5, 2024 · 3e4cce1 · 3e4cce1
1 parent 0cd64c9
commit 3e4cce1
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/taky/dps/__main__.py b/taky/dps/__main__.py
@@ -53,6 +53,19 @@ def handle_request(self, listener, req, client, addr):
         headers = dict(req.headers)
         peer_cert = client.getpeercert()
 
+        # Don't let users specify these header values
+        forbidden_keys = [
+            "X-USER",
+            "X-SERIAL_NUMBER",
+            "X-ISSUER",
+            "X-REVOKED",
+            "X-NOT_BEFORE",
+            "X-NOT_AFTER",
+        ]
+        for keyname in forbidden_keys:
+            if keyname in headers:
+                headers.pop(keyname)
+
         if peer_cert:
             subject = dict(
                 [i for subtuple in peer_cert.get("subject") for i in subtuple]