Files
zulip/zerver/webhooks/dropbox/view.py
Anders Kaseorg 83380b4296 CVE-2020-12759: Fix reflected XSS vulnerability in Dropbox webhook.
Also check the challenge argument’s presence before using it.

Signed-off-by: Anders Kaseorg <anders@zulip.com>
2020-06-16 23:12:40 -07:00

27 lines
1.0 KiB
Python

from typing import Optional
from django.http import HttpRequest, HttpResponse
from zerver.lib.request import REQ, RequestVariableMissingError
from zerver.lib.response import json_success
from zerver.lib.webhooks.common import check_send_webhook_message
from zerver.decorator import has_request_variables, api_key_only_webhook_view
from zerver.models import UserProfile
@api_key_only_webhook_view('Dropbox', notify_bot_owner_on_invalid_json=False)
@has_request_variables
def api_dropbox_webhook(
request: HttpRequest,
user_profile: UserProfile,
challenge: Optional[str]=REQ(default=None),
) -> HttpResponse:
if request.method == 'POST':
topic = 'Dropbox'
check_send_webhook_message(request, user_profile, topic,
"File has been updated on Dropbox!")
return json_success()
else:
if challenge is None:
raise RequestVariableMissingError("challenge")
return HttpResponse(challenge, content_type="text/plain; charset=UTF-8")