mirror of
https://github.com/rclone/rclone.git
synced 2026-10-28 14:28:38 -04:00
Nick Craig-Wood
a53fdac5ec
The local web server which receives the OAuth callback during `rclone config` and `rclone authorize` checks that the `state` parameter matches the random value rclone generated when starting the flow. The pcloud backend opted out of this check with the `StateBlankOK` option in lib/oauthutil, which made the local server accept a callback with no state at all. The callback URL (http://127.0.0.1:53682/) is fixed and well known, so while a pcloud OAuth flow was in progress any web page open in the user's browser could complete it with a single cross-site request carrying an attacker's authorization code. This is a CSRF (CWE-352) on the auth callback. This commit removes the `StateBlankOK` option so that every callback must carry the correct state and adds a test that the local auth server rejects callbacks with a blank, missing or wrong state. The option was added in May 2020 (#4210) because pCloud briefly omitted the state parameter from its redirect. The callbacks recorded five weeks later when EU region support was added show both api.pcloud.com and eapi.pcloud.com returning `state=` again, so the exemption has been unnecessary since then. See: GHSA-hvpr-p4pv-4f46