{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/core/issues/18254","labels_url":"https://api.github.com/repos/owncloud/core/issues/18254/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/core/issues/18254/comments","events_url":"https://api.github.com/repos/owncloud/core/issues/18254/events","html_url":"https://github.com/owncloud/core/pull/18254","id":100694531,"number":18254,"title":"Add mitigation against BREACH","user":{"login":"LukasReschke","id":878997,"avatar_url":"https://avatars.githubusercontent.com/u/878997?v=3","gravatar_id":"","url":"https://api.github.com/users/LukasReschke","html_url":"https://github.com/LukasReschke","followers_url":"https://api.github.com/users/LukasReschke/followers","following_url":"https://api.github.com/users/LukasReschke/following{/other_user}","gists_url":"https://api.github.com/users/LukasReschke/gists{/gist_id}","starred_url":"https://api.github.com/users/LukasReschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LukasReschke/subscriptions","organizations_url":"https://api.github.com/users/LukasReschke/orgs","repos_url":"https://api.github.com/users/LukasReschke/repos","events_url":"https://api.github.com/users/LukasReschke/events{/privacy}","received_events_url":"https://api.github.com/users/LukasReschke/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/core/labels/3%20-%20To%20Review","name":"3 - To Review","color":"ededed"},{"url":"https://api.github.com/repos/owncloud/core/labels/enhancement","name":"enhancement","color":"02e10c"},{"url":"https://api.github.com/repos/owncloud/core/labels/security","name":"security","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/owncloud/core/milestones/37","html_url":"https://github.com/owncloud/core/milestones/8.2-current","labels_url":"https://api.github.com/repos/owncloud/core/milestones/37/labels","id":993629,"number":37,"title":"8.2-current","description":"","creator":{"login":"craigpg","id":160667,"avatar_url":"https://avatars.githubusercontent.com/u/160667?v=3","gravatar_id":"","url":"https://api.github.com/users/craigpg","html_url":"https://github.com/craigpg","followers_url":"https://api.github.com/users/craigpg/followers","following_url":"https://api.github.com/users/craigpg/following{/other_user}","gists_url":"https://api.github.com/users/craigpg/gists{/gist_id}","starred_url":"https://api.github.com/users/craigpg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/craigpg/subscriptions","organizations_url":"https://api.github.com/users/craigpg/orgs","repos_url":"https://api.github.com/users/craigpg/repos","events_url":"https://api.github.com/users/craigpg/events{/privacy}","received_events_url":"https://api.github.com/users/craigpg/received_events","type":"User","site_admin":false},"open_issues":634,"closed_issues":346,"state":"open","created_at":"2015-02-24T16:19:37Z","updated_at":"2015-08-13T15:26:35Z","due_on":"2015-10-20T04:00:00Z","closed_at":null},"comments":5,"created_at":"2015-08-13T05:42:49Z","updated_at":"2015-08-13T17:35:44Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/owncloud/core/pulls/18254","html_url":"https://github.com/owncloud/core/pull/18254","diff_url":"https://github.com/owncloud/core/pull/18254.diff","patch_url":"https://github.com/owncloud/core/pull/18254.patch"},"body":"While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:\r\n\r\n1. Application must support HTTP compression\r\n2. Response most reflect user-controlled input\r\n3. Response should contain sensitive data\r\n\r\nEspecially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed. (though there are parts such as the search box…)\r\n\r\nTo reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least. \r\n\r\nWe might consider a backport to 8.1 but not earlier versions. With 8.1 the requesttoken may anyways contain data that needs encoding thus this should not hurt there.\r\n\r\ncc @owncloud/security-team Care to review?"},"comment":{"url":"https://api.github.com/repos/owncloud/core/issues/comments/130772973","html_url":"https://github.com/owncloud/core/pull/18254#issuecomment-130772973","issue_url":"https://api.github.com/repos/owncloud/core/issues/18254","id":130772973,"user":{"login":"owncloud-bot","id":2709266,"avatar_url":"https://avatars.githubusercontent.com/u/2709266?v=3","gravatar_id":"","url":"https://api.github.com/users/owncloud-bot","html_url":"https://github.com/owncloud-bot","followers_url":"https://api.github.com/users/owncloud-bot/followers","following_url":"https://api.github.com/users/owncloud-bot/following{/other_user}","gists_url":"https://api.github.com/users/owncloud-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/owncloud-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/owncloud-bot/subscriptions","organizations_url":"https://api.github.com/users/owncloud-bot/orgs","repos_url":"https://api.github.com/users/owncloud-bot/repos","events_url":"https://api.github.com/users/owncloud-bot/events{/privacy}","received_events_url":"https://api.github.com/users/owncloud-bot/received_events","type":"User","site_admin":false},"created_at":"2015-08-13T17:35:44Z","updated_at":"2015-08-13T17:35:44Z","body":":rocket: Test PASSed.:rocket:\n![chuck](https://cloud.githubusercontent.com/assets/1005065/6865211/d99978f2-d46b-11e4-9c1d-66f21a737511.jpg)\n"}}