bleedingdeacons / reach / 34297137128
86%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 92
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 86.366% (+0.02%) from 86.349%
34297137128

push

github

web-flow 
fix: vouch for Trusted's sign-up writes with the session token (#113)

Trusted's POST /signup and DELETE /signup/{rota} resolve the acting member
only through the trusted_signup_member filter, which Plugin::init() answers
from Reach's session cookie. That makes them cookie-authenticated writes: a
browser attaches the cookie to a cross-site request by itself, so the two
endpoints were forgeable, and the only thing in the way was the cookie's own
SameSite=Lax.

SessionCsrf's docblock is already the best statement of why that is not
enough — an older browser, Chrome's grace period on a freshly-set cookie, or
anything on a sibling subdomain defeats it. The grace window matters here in
particular because it opens exactly as a responder lands back from the OAuth
redirect. Reach's own cookie-authenticated writes have all verified
X-Reach-Token for this reason; these two were missed because they live in
another plugin.

Trusted cannot check the token without depending on Reach, so it now asks
via trusted_signup_verify_request and refuses by default. This answers that
filter with SessionCsrf::verify(), keeping the check where the token is
minted, and stays inert when Trusted is not installed.

shifts.js was already given the token by the shifts page but never sent it —
only the sign-out call did. It now goes on api()'s default headers rather
than at each call site, so the next write added to that file cannot silently
omit it. The read ignores it.

Ships before the matching Trusted change: this half is inert on its own,
whereas Trusted's refuses writes until something vouches for them.

6233 of 7217 relevant lines covered (86.37%)

14.93 hits per line

Coverage Regressions

Lines Coverage ∆ File
11
84.38
1.62% reach/reach/src/Plugin.php
Jobs
ID Job ID Ran Files Coverage
1 34297137128.1 92
86.37
GitHub Action Run
Source Files on build 34297137128