RocketChat / RocketChat/Rocket.Chat

about General Options to X-Frame-Options Added an error header to the generic iFrame

Open
#19,695 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

Added an error header to the General iFrame
add_header x-frame-options "allow-From https://example.com/";
Due to my local use of Nginx, I have reported an error as follows. The links to the local LAN(http://10.10.10.20:3000) and the reverse proxy cannot be accessed(url https://www.examble.net)
image

Steps to reproduce:
Expected behavior:

Because of my operation error, the syntax error of adding the header caused my service to be inaccessible. Request to modify this, the wrong syntax should not be added, causing the service to be unable to run

Actual behavior:
Server Setup Information:
  • Version of Rocket.Chat Server: 3.8.1
  • Operating System: centos8x64
  • Deployment Method: Manual Installation
  • Number of Running Instances: 2
  • DB Replicaset Oplog: wiredTiger
  • NodeJS Version: v12.18.4
  • MongoDB Version:4.2.3
Client Setup Information
  • Desktop App or Browser Version: all
  • Operating System:windows
Additional context
Relevant logs:
   Loaded: loaded (/usr/lib/systemd/system/rocketchat.service; enabled; vendor preset: disabled)
   Active: active (running) since Fri 2020-11-27 22:59:00 CST; 3min 47s ago
 Main PID: 153178 (node)
    Tasks: 11 (limit: 62658)
   Memory: 429.8M
   CGroup: /system.slice/rocketchat.service
           └─153178 /usr/local/bin/node /opt/Rocket.Chat/main.js

Nov 27 23:01:39 sslchat rocketchat[153178]:     at ServerResponse.res.setHeader (/opt/Rocket.Chat/programs/server/npm/node_modules/meteor/simple_json-routes/node_modules/connect/lib/pat>
Nov 27 23:01:39 sslchat rocketchat[153178]:     at app/cors/server/cors.js:61:7
Nov 27 23:01:39 sslchat rocketchat[153178]:     at /opt/Rocket.Chat/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/fiber_pool.js:43:40 {
Nov 27 23:01:39 sslchat rocketchat[153178]:   code: 'ERR_INVALID_CHAR'
Nov 27 23:01:39 sslchat rocketchat[153178]: }
Nov 27 23:01:39 sslchat rocketchat[153178]: ---------------------------------
Nov 27 23:01:39 sslchat rocketchat[153178]: Errors like this can cause oplog processing errors.
Nov 27 23:01:39 sslchat rocketchat[153178]: Setting EXIT_UNHANDLEDPROMISEREJECTION will cause the process to exit allowing your service to automatically restart the process
Nov 27 23:01:39 sslchat rocketchat[153178]: Future node.js versions will automatically exit the process
Nov 27 23:01:39 sslchat rocketchat[153178]: =================================```

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with app/cors/server/cors.js at the reported line 61 and reproduce the invalid X-Frame-Options header while using the described Nginx reverse-proxy setup. Check the Node.js logs for ERR_INVALID_CHAR; the work is complete when the invalid header no longer makes the Rocket.Chat service inaccessible.

Written by the indexing model from the issue text.

Assessment

Tech stack
nginx, node.js
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.