Project

General

Profile

Actions
Copy link

Bug #26033

closed

Openscap report cannot open in iframe since CSRF headers

Added by Clark ANDRIANASOLO 15 days ago. Updated 5 days ago.

Status:
Released
Priority:
1 (highest)
Assignee:
Clark ANDRIANASOLO
Target version:
Rudder plugins - 8.1
Pull Request:
https://github.com/Normation/rudder-p...
Severity:
Major - prevents use of part of Rudder | no simple workaround
UX impact:
It bothers me each time
User visibility:
Getting started - demo | first install | Technique editor and level 1 Techniques
Effort required:
Small
Priority:
130
Name check:
To do
Fix check:
To do
Regression:
No

Description

When displaying an openscap report in 8.2, we end up having an iframe component with a CRSF error :

This is due to the iframe calling an Openscap API endpoint as its src but the CSRF mitigation headers are missing.
Therefore the HTML report cannot be loaded, even though it is exists at /var/rudder/shared-files/root/files/<nodeId>/openscap_report.html

We should have a safe way to render the openscap HTML content directly into the page.

Files

clipboard-202412061052-a2ttx.png (37.2 KB) clipboard-202412061052-a2ttx.png Clark ANDRIANASOLO, 2024-12-06 10:52

Subtasks 2 (0 open — 2 closed)

Bug #26065: OpenSCAP report needs to be rendered without iframe with sanitized htmlReleasedFrançois ARMANDActions
Bug #26066: OpenSCAP needs queryContext and has build issues from stale properties fileReleasedFrançois ARMANDActions

Related issues 1 (1 open — 0 closed)

Related to Rudder - Architecture #26068: Deny iframes in RudderPending releaseClark ANDRIANASOLOActions
Actions
Copy link
 #1

Updated by Clark ANDRIANASOLO 15 days ago

  • Description updated (diff)
Actions
Copy link
 #3

Updated by Elaad FURREEDAN 12 days ago

  • Priority changed from 97 to 130
Actions
Copy link
 #4

Updated by Nicolas CHARLES 9 days ago

  • Priority changed from To review to 1 (highest)
Actions
Copy link
 #5

Updated by François ARMAND 9 days ago

  • Target version changed from 8.2 to 8.1

We will need to adapt the whole sanitization to make that work. We don't need any js on openscap reports.

Actions
Copy link
 #6

Updated by François ARMAND 9 days ago

  • Status changed from New to In progress
  • Assignee changed from Clark ANDRIANASOLO to François ARMAND
Actions
Copy link
 #7

Updated by François ARMAND 9 days ago

  • Status changed from In progress to Pending technical review
  • Assignee changed from François ARMAND to Clark ANDRIANASOLO
  • Pull Request set to https://github.com/Normation/rudder-plugins/pull/777
Actions
Copy link
 #8

Updated by Anonymous 8 days ago

  • Status changed from Pending technical review to Pending release
Actions
Copy link
 #9

Updated by Clark ANDRIANASOLO 8 days ago

  • Subtask #26065 added
Actions
Copy link
 #10

Updated by Clark ANDRIANASOLO 8 days ago

  • Subtask #26066 added
Actions
Copy link
 #11

Updated by Alexis Mousset 8 days ago

Actions
Copy link
 #12

Updated by Vincent MEMBRÉ 5 days ago

This bug has been fixed in Rudder plugin openscap v8.1.10-2.2

Actions
Copy link
 #13

Updated by Vincent MEMBRÉ 5 days ago

  • Status changed from Pending release to Released

This bug has been fixed in Rudder plugin openscap v8.2.3-2.2

Actions
Copy link

Also available in: Atom PDF