jeans/supervisor
jeans/supervisor
1
0
Fork 0
mirror of https://github.com/home-assistant/supervisor.git synced 2025-07-09 10:16:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enable Security API (#710)

Browse Source 
* Enable Security API

* Update addons.py

* Update proxy.py

* Update __init__.py

* Update security.py

* Fix lint
This commit is contained in:
Pascal Vizeli 2018-09-24 15:11:33 +02:00 committed by GitHub
parent 267791833e
commit 52da7605f5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 12 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
hassio/addons/__init__.py
View File

@ -43,13 +43,6 @@ class AddonManager(CoreSysAttributes):
"""Return an add-on from slug.""" """Return an add-on from slug."""
return self.addons_obj.get(addon_slug) return self.addons_obj.get(addon_slug)
def from_uuid(self, uuid):
"""Return an add-on from UUID."""
for addon in self.list_addons:
if addon.is_installed and uuid == addon.uuid:
return addon
return None
def from_token(self, token): def from_token(self, token):
"""Return an add-on from Hass.io token.""" """Return an add-on from Hass.io token."""
for addon in self.list_addons: for addon in self.list_addons:

8
hassio/api/addons.py
View File

@ -24,7 +24,6 @@ from ..const import (
CONTENT_TYPE_PNG, CONTENT_TYPE_BINARY, CONTENT_TYPE_TEXT, REQUEST_FROM) CONTENT_TYPE_PNG, CONTENT_TYPE_BINARY, CONTENT_TYPE_TEXT, REQUEST_FROM)
from ..coresys import CoreSysAttributes from ..coresys import CoreSysAttributes
from ..validate import DOCKER_PORTS, ALSA_DEVICE from ..validate import DOCKER_PORTS, ALSA_DEVICE
from ..exceptions import APINotSupportedError
_LOGGER = logging.getLogger(__name__) _LOGGER = logging.getLogger(__name__)
@ -196,13 +195,6 @@ class APIAddons(CoreSysAttributes):
async def security(self, request): async def security(self, request):
"""Store security options for add-on.""" """Store security options for add-on."""
addon = self._extract_addon(request) addon = self._extract_addon(request)
# Have Access
# REMOVE: don't needed anymore
if addon.slug == request[REQUEST_FROM]:
_LOGGER.error("Can't self modify his security!")
raise APINotSupportedError()
body = await api_validate(SCHEMA_SECURITY, request) body = await api_validate(SCHEMA_SECURITY, request)
if ATTR_PROTECTED in body: if ATTR_PROTECTED in body:

8
hassio/api/proxy.py
View File

@ -25,10 +25,6 @@ class APIProxy(CoreSysAttributes):
hassio_token = request.headers.get(HEADER_HA_ACCESS) hassio_token = request.headers.get(HEADER_HA_ACCESS)
addon = self.sys_addons.from_token(hassio_token) addon = self.sys_addons.from_token(hassio_token)
# REMOVE 132
if not addon:
addon = self.sys_addons.from_uuid(hassio_token)
if not addon: if not addon:
_LOGGER.warning("Unknown Home Assistant API access!") _LOGGER.warning("Unknown Home Assistant API access!")
elif not addon.access_homeassistant_api: elif not addon.access_homeassistant_api:
@ -184,10 +180,6 @@ class APIProxy(CoreSysAttributes):
response.get('access_token')) response.get('access_token'))
addon = self.sys_addons.from_token(hassio_token) addon = self.sys_addons.from_token(hassio_token)
# REMOVE 132
if not addon:
addon = self.sys_addons.from_uuid(hassio_token)
if not addon or not addon.access_homeassistant_api: if not addon or not addon.access_homeassistant_api:
_LOGGER.warning("Unauthorized WebSocket access!") _LOGGER.warning("Unauthorized WebSocket access!")
await server.send_json({ await server.send_json({

16
hassio/api/security.py
View File

@ -12,6 +12,14 @@ from ..coresys import CoreSysAttributes
_LOGGER = logging.getLogger(__name__) _LOGGER = logging.getLogger(__name__)
# Block Anytime
BLACKLIST = re.compile(
r"^(?:"
r"|/homeassistant/api/hassio/.*"
r")$"
)
# Free to call or have own security concepts # Free to call or have own security concepts
NO_SECURITY_CHECK = re.compile( NO_SECURITY_CHECK = re.compile(
r"^(?:" r"^(?:"
@ -74,6 +82,10 @@ class SecurityMiddleware(CoreSysAttributes):
request_from = None request_from = None
hassio_token = request.headers.get(HEADER_TOKEN) hassio_token = request.headers.get(HEADER_TOKEN)
# Blacklist
if BLACKLIST.match(request.path):
raise HTTPForbidden()
# Ignore security check # Ignore security check
if NO_SECURITY_CHECK.match(request.path): if NO_SECURITY_CHECK.match(request.path):
_LOGGER.debug("Passthrough %s", request.path) _LOGGER.debug("Passthrough %s", request.path)
@ -100,9 +112,6 @@ class SecurityMiddleware(CoreSysAttributes):
addon = None addon = None
if hassio_token and not request_from: if hassio_token and not request_from:
addon = self.sys_addons.from_token(hassio_token) addon = self.sys_addons.from_token(hassio_token)
# REMOVE 132
if not addon:
addon = self.sys_addons.from_uuid(hassio_token)
# Check Add-on API access # Check Add-on API access
if addon and ADDONS_API_BYPASS.match(request.path): if addon and ADDONS_API_BYPASS.match(request.path):
@ -115,7 +124,6 @@ class SecurityMiddleware(CoreSysAttributes):
request_from = addon.slug request_from = addon.slug
else: else:
_LOGGER.warning("%s no role for %s", request.path, addon.slug) _LOGGER.warning("%s no role for %s", request.path, addon.slug)
request_from = addon.slug # REMOVE: 132
if request_from: if request_from:
request[REQUEST_FROM] = request_from request[REQUEST_FROM] = request_from