Bug 1489389

Summary:	[RFE] Regex matching allows for potential CORS security vulnerability in web console
Product:	OpenShift Container Platform	Reporter:	David Caldwell <dcaldwel>
Component:	RFE	Assignee:	Michal Fojtik <mfojtik>
Status:	CLOSED WONTFIX	QA Contact:	Xiaoli Tian <xtian>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	3.5.0	CC:	aos-bugs, erich, jokerman, mfojtik, mmccomas, pdwyer, pweil, smulholland, spadgett
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-12 11:56:59 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Caldwell 2017-09-07 10:43:05 UTC

1. Proposed title of this feature request
Improve regex matching in web console to tighten potential CORS misuse

3. Please see private comment regarding vulnerability details.

5. How would the customer like to achieve this? (List the functional requirements here)
Tightening CORS vulnerability
 
6. For each functional requirement listed in question 5, specify how Red Hat
and the customer can test to confirm the requirement is successfully implemented.
By reproducing the testing described above

7. Is there already an existing RFE upstream or in Red Hat bugzilla?
No
 
10. List any affected packages or components.
Web console

Comment 12 Kirsten Newcomer 2019-06-12 11:56:59 UTC

With the introduction of OpenShift 4, Red Hat has delivered or roadmapped a substantial number of features based on feedback by our customers.  Many of the enhancements encompass specific RFEs which have been requested, or deliver a comparable solution to a customer problem, rendering an RFE redundant.

This bz (RFE) has been identified as a feature request not yet planned or scheduled for an OpenShift release and is being closed. 

If this feature is still an active request that needs to be tracked, Red Hat Support can assist in filing a request in the new JIRA RFE system, as well as provide you with updates as the RFE progress within our planning processes. Please open a new support case: https://access.redhat.com/support/cases/#/case/new 

Opening a New Support Case: https://access.redhat.com/support/cases/#/case/new 

As the new Jira RFE system is not yet public, Red Hat Support can help answer your questions about your RFEs via the same support case system.