mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 13:08:40 +08:00
61f12e13aa
Any AWS account holder can subscribe their own SNS topic to a Discourse instance's /webhooks/aws and publish bounce notifications that AWS will sign legitimately. The forged bounces are processed against arbitrary user emails, bumping bounce_score and eventually triggering email revocation.. This fix adds a new `aws_sns_topic_arn_allowlist` site setting. Also hardens Jobs::ProcessSnsNotification against three issues: - Binds bounces to (message_id, to_address) via find_by, so a legitimately-subscribed SNS publisher can no longer bounce arbitrary recipients we didn't send to. - Skips duplicate notifications (next if email_log.bounced?) — AWS SNS delivers at-least-once. - Uses update! instead of update_columns so EmailLog's existing before_save normalizes the bounce status code. Also add a dashboard problem flags self-hosted admins whose SMTP looks like SES but who haven't set the allowlist yet. https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x
25 lines
579 B
Ruby
Vendored
25 lines
579 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
module Jobs
|
|
class ConfirmSnsSubscription < ::Jobs::Base
|
|
sidekiq_options retry: false
|
|
|
|
def execute(args)
|
|
return unless raw = args[:raw].presence
|
|
return unless json = args[:json].presence
|
|
return unless subscribe_url = json["SubscribeURL"].presence
|
|
|
|
return if !Email::Sns.allowed_topic_arn?(json["TopicArn"])
|
|
return unless Email::Sns.authentic?(raw)
|
|
|
|
uri =
|
|
begin
|
|
URI.parse(subscribe_url)
|
|
rescue URI::Error
|
|
return
|
|
end
|
|
|
|
Net::HTTP.get(uri)
|
|
end
|
|
end
|
|
end
|
