lichenblankie/tinyweb
2
0
Fork 0
Code Issues Pull requests Projects 1 Releases Packages Wiki Activity Actions

expand RNS whitelist: allow GET /, /about, /pages, /tags, /share via gateway

Browse source
This commit is contained in:
blankie 2026-06-18 17:15:15 +00:00
parent 4468ba89ad
commit 1eb0760a55
1 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/tinyweb/app.py
View file

@ -73,11 +73,22 @@ def load_or_create_identity():
return identity
# Remote peers on the Reticulum mesh can only reach a narrow, read-only surface.
# Any other method/path is rejected here — CSRF cannot authenticate mesh callers
# (the attacker controls both the "cookie" and the "form" side of the check), so
# gating by whitelist is the only safe option.
_RNS_ALLOWED = {("GET", "/api/sites")}
# Remote peers on the Reticulum mesh can reach read-only public pages.
# Only GET is allowed; POST is blocked because CSRF cannot authenticate
# mesh callers (the attacker controls both the "cookie" and the "form" side).
_RNS_ALLOWED_GET = {
"/", "/about", "/api/sites", "/share/preview",
}
_RNS_ALLOWED_PREFIXES = ("/pages", "/tags", "/api/sites")
def _rns_is_allowed(method, path):
if method != "GET":
return False
if path in _RNS_ALLOWED_GET:
return True
return any(path.startswith(p) for p in _RNS_ALLOWED_PREFIXES)
def rns_request_handler(path, data, request_id, link_id, remote_identity, requested_at):
@ -85,7 +96,7 @@ def rns_request_handler(path, data, request_id, link_id, remote_identity, reques
data = {"method": "GET", "path": "/", "query": {}, "body": {}, "gateway_host": ""}
method = data.get("method", "GET")
req_path = data.get("path", "/")
if (method, req_path) not in _RNS_ALLOWED:
if not _rns_is_allowed(method, req_path):
return {
"status": 403,
"content_type": "text/plain; charset=utf-8",