fix(http): distinguish binary transfer cache request bodies - #70227
fix(http): distinguish binary transfer cache request bodies#70227SkyZeroZx wants to merge 1 commit into
Conversation
Sorry, something went wrong.
| }); | ||
| }); | ||
|
|
||
| it('should not cache POST requests with Blob bodies', () => { |
There was a problem hiding this comment.
Looking into it a bit more, we could try wrapping it in observables and modifying the interceptor in transferCache, but that would be extra work and would further increase the bundle size.
I'm not sure if it's worthwhile or if we should revisit it later.
Sorry, something went wrong.
| bodyForCacheKey = sortAndConcatParams(serializedBody); | ||
| } else if (serializedBody instanceof ArrayBuffer) { | ||
| bodyType = 'arrayBuffer'; | ||
| bodyForCacheKey = toBase64(serializedBody); |
There was a problem hiding this comment.
I do see a concern with very large bodies here.
Sorry, something went wrong.
There was a problem hiding this comment.
updated, we can directly use the ArrayBuffer bytes to convert it to SHA-256, avoiding unnecessary conversion back to bytes.
Sorry, something went wrong.
| @@ -1,5 +1,5 @@ | |||
| { | |||
| "dist/browser/main-[hash].js": 232419, | |||
| "dist/browser/main-[hash].js": 237440, | |||
There was a problem hiding this comment.
Apparently, it was not updated (or exceeded the accepted tolerance) when SHA-256 was added.
Sorry, something went wrong.
Include the serialized body type and ArrayBuffer bytes in transfer cache keys. Avoid caching Blob and FormData requests when a complete synchronous identity cannot be derived. Prevent distinct protobuf and gRPC POST payloads from sharing a cache entry during hydration. Fixes angular#70226
Include the serialized body type and ArrayBuffer bytes in transfer cache keys. Avoid caching Blob and FormData requests when a complete synchronous identity cannot be derived.
Prevent distinct protobuf and gRPC POST payloads from sharing a cache entry during hydration.
Fixes #70226
The impact is similar to other cache poisoning or cache-key confusion issues: distinct attacker-controlled protobuf or gRPC bodies could collide on the same cache key, causing a response cached for one request to be incorrectly reused for another during hydration , similar to advisories such as GHSA-jhpw-976m-542j and GHSA-39pv-4j6c-2g6v.
A minimal example can also be seen at https://github.com/SkyZeroZx/angular-protobuf-transfercache-poc