CVE-2022-3457: Enforce 'Origin' validation · ikus060/rdiffweb@afc1bdf

@@ -93,6 +93,15 @@ def test_post_with_wrong_origin(self): self.assertStatus(403) self.assertInBody(‘Unexpected Origin header’)
def test_post_with_prefixed_origin(self): # Given a POST request made to rdiffweb # When the request is made using a different origin base = ‘http://%s:%s’ % (self.HOST + 'anything.com’, self.PORT) self.getPage('/dashboard/’, headers=[(‘Origin’, base)], method=’POST’) # Then the request is accepted with 200 OK self.assertStatus(403) self.assertInBody(‘Unexpected Origin header’)
def test_post_with_valid_origin(self): # Given a POST request made to rdiffweb # When the request is made using a different origin