aio-interface: fix token history leak, streaming XSS and missing cache headers by Copilot · Pull Request #8049 · nextcloud/all-in-one

Copilot · 2026-05-04T10:14:53Z

No description provided.

…SS, borg password persistence, and missing cache headers Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

…y script Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

…rove comments Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

…tighten URL validation Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

…_fetch success param Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

…ing and GetTryLogin HTML redirect Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/55bc79a5-dea6-4bcf-9d13-030209b54382 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

…rd clearing and GetTryLogin HTML redirect" This reverts commit 68bb93a.

…addressed in separate PRs) Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/d7eb7ba7-23d8-4082-8255-09f1338de24b Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

pabzm

Without a description I can only comment on the technical implementation, not on the intention.

pabzm · 2026-05-18T15:54:20Z

        'community_containers_enabled' => $configurationManager->aioCommunityContainers,
        'bypass_container_update' => $bypass_container_update,
-    ]);
+    ])->withHeader('Cache-Control', 'no-store');


Shouldn't these headers probably be added in more places?

I've split this change up into a separate PR: #8161

pabzm · 2026-05-18T16:00:24Z

@@ -0,0 +1,26 @@
+// This script is loaded after a successful token-based login.


I think this is a crutch for a problem that wouldn't exist if we'd use a POST-request for the indirect login, which is more appropriate for a login-request anyways. (Or replace it fully e.g. by a cookie as discussed in #7686).

I'd favour to change the login request method instead of this.

I fear a cross-site Post is possible but would probably require an adjusted CSP inside Nextcloud and IAO to make it work... Also not sure about CSRF...

pabzm · 2026-05-18T16:08:04Z

        // wanted markup or formatting.
        $addToStreamingResponseBody = function (Container $container, string $message) use ($nonbufResp) : void {
-            $nonbufResp->getBody()->write("<div>{$container->displayName}: {$message}</div>");
+            $nonbufResp->getBody()->write('<div>' . htmlspecialchars($container->displayName, ENT_QUOTES | ENT_HTML5) . ': ' . htmlspecialchars($message, ENT_QUOTES | ENT_HTML5) . '</div>');


As far as I can tell this would result in the HTML-encoded entities being visible as text in the log view overlay.

Was there an actual XSS found? The JS code in log-view.js deliberately inserts the text in a way that should be safe, thus I'm wondering if this comes from a wild guess or from an actual vulnerability.

No this does not come from a vulnerability found. Probably we don't need this then.

szaimen · 2026-05-19T14:24:07Z

This PR probably needs more discussions. Lets for now continue in #8161

Copilot AI and others added 6 commits May 4, 2026 09:56

security: address code-review comments on rate-limit and clean-histor…

8356d0d

…y script Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

security: address second round of code-review comments

6a9e55a

Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

security: use persistent HMAC key, validate clean-history target, imp…

ef58220

…rove comments Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

security: enforce APCu availability, fix fixed-window rate limiting, …

79e05f3

…tighten URL validation Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

security: null-check currentScript, handle apcu_inc failure, use apcu…

a415c76

…_fetch success param Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/f1016d36-0771-46e0-992c-95ce22594414 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

Copilot AI assigned Copilot and szaimen May 4, 2026

Copilot created this pull request from a session on behalf of szaimen May 4, 2026 10:14 View session

szaimen mentioned this pull request May 4, 2026

publish new images after recent PRs are merged and tested #8033

Closed

23 tasks

szaimen reviewed May 4, 2026

View reviewed changes

Comment thread php/src/Controller/DockerController.php Outdated

szaimen reviewed May 4, 2026

View reviewed changes

Comment thread php/src/Controller/LoginController.php Outdated

szaimen added 2. developing Work in progress enhancement New feature or request labels May 4, 2026

szaimen added this to the next milestone May 4, 2026

szaimen changed the title ~~security: fix brute-force protection, token history leak, streaming XSS, borg password persistence, and missing cache headers~~ aio-interface: fix brute-force protection, token history leak, streaming XSS, borg password persistence, and missing cache headers May 4, 2026

szaimen modified the milestones: v13.0.1, next May 4, 2026

This was referenced May 4, 2026

publish new images after recent PRs are merged and tested #8053

Closed

publish new images after recent PRs are merged and tested #8063

Closed

szaimen modified the milestones: v13.0.2, next May 6, 2026

szaimen mentioned this pull request May 7, 2026

publish new images after recent PRs are merged and tested #8065

Closed

19 tasks

szaimen modified the milestones: v13.0.3, next May 7, 2026

Copilot started work on behalf of szaimen May 12, 2026 09:52 View session

revert: address PR review comments - remove borgRestorePassword clear…

68bb93a

…ing and GetTryLogin HTML redirect Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/55bc79a5-dea6-4bcf-9d13-030209b54382 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

Copilot finished work on behalf of szaimen May 12, 2026 09:56

Copilot AI requested a review from szaimen May 12, 2026 09:56

Revert "revert: address PR review comments - remove borgRestorePasswo…

adcc41f

…rd clearing and GetTryLogin HTML redirect" This reverts commit 68bb93a.

Copilot started work on behalf of szaimen May 12, 2026 10:00 View session

revert: remove borgRestorePassword clearing and rate limiting (to be …

bbafd6f

…addressed in separate PRs) Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/d7eb7ba7-23d8-4082-8255-09f1338de24b Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>

Copilot finished work on behalf of szaimen May 12, 2026 10:03

szaimen marked this pull request as ready for review May 12, 2026 10:04

szaimen added 3. to review Waiting for reviews and removed 2. developing Work in progress labels May 12, 2026

szaimen requested a review from pabzm May 12, 2026 10:04

szaimen changed the title ~~aio-interface: fix brute-force protection, token history leak, streaming XSS, borg password persistence, and missing cache headers~~ aio-interface: fix token history leak, streaming XSS and missing cache headers May 12, 2026

szaimen mentioned this pull request May 15, 2026

publish new images after recent PRs are merged and tested #8113

Closed

30 tasks

szaimen modified the milestones: v13.0.4, next May 15, 2026

pabzm reviewed May 18, 2026

View reviewed changes

szaimen mentioned this pull request May 19, 2026

aio-interface: do not cache the containers, logs and setup screen as it shows credentials #8161

Merged

szaimen added 2. developing Work in progress and removed 3. to review Waiting for reviews labels May 19, 2026

szaimen removed this from the next milestone May 19, 2026

szaimen marked this pull request as draft June 17, 2026 13:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

aio-interface: fix token history leak, streaming XSS and missing cache headers#8049

aio-interface: fix token history leak, streaming XSS and missing cache headers#8049
szaimen with Copilot wants to merge 9 commits into
mainfrom
copilot/security-analysis-suggestions

Copilot AI commented May 4, 2026 •

edited by szaimen

Loading

Uh oh!

Uh oh!

Uh oh!

pabzm left a comment

Uh oh!

pabzm May 18, 2026

Uh oh!

szaimen May 19, 2026

Uh oh!

pabzm May 18, 2026

Uh oh!

szaimen May 19, 2026 •

edited

Loading

Uh oh!

pabzm May 18, 2026

Uh oh!

szaimen May 19, 2026

Uh oh!

szaimen commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -0,0 +1,26 @@
		// This script is loaded after a successful token-based login.

Uh oh!

Conversation

Copilot AI commented May 4, 2026 • edited by szaimen Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pabzm left a comment

Choose a reason for hiding this comment

Uh oh!

pabzm May 18, 2026

Choose a reason for hiding this comment

Uh oh!

szaimen May 19, 2026

Choose a reason for hiding this comment

Uh oh!

pabzm May 18, 2026

Choose a reason for hiding this comment

Uh oh!

szaimen May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pabzm May 18, 2026

Choose a reason for hiding this comment

Uh oh!

szaimen May 19, 2026

Choose a reason for hiding this comment

Uh oh!

szaimen commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 4, 2026 •

edited by szaimen

Loading

szaimen May 19, 2026 •

edited

Loading