Disallow POST to /assets/

gratipay/main.py

@@ -99,14 +99,14 @@
     algorithm['parse_environ_into_request'],
     algorithm['parse_body_into_request'],
 
+    security.only_allow_certain_methods,
     utils.use_tildes_for_participants,
     algorithm['redirect_to_base_url'],
     i18n.set_up_i18n,
     authentication.start_user_as_anon,
     authentication.authenticate_user_if_possible,
     csrf.extract_token_from_cookie,
     csrf.reject_forgeries,
-    security.only_allow_certain_methods,
 
     algorithm['dispatch_request_to_filesystem'],
 

gratipay/security/__init__.py

@@ -1,9 +1,14 @@
 from aspen import Response
 
 
+_requesting_asset = lambda r: r.path.raw.startswith('/assets/')
+
+
 def only_allow_certain_methods(request):
-    whitelisted = ['GET', 'HEAD', 'POST']
-    if request.method.upper() not in whitelisted:
+    method = request.method.upper()
+    whitelist = ('GET', 'HEAD') if _requesting_asset(request) else ('GET', 'HEAD', 'POST')
+    # POSTing to /assets/ interferes with the csrf.* functions if we're not careful
+    if method not in whitelist:
         raise Response(405)
 
 

gratipay/security/csrf.py

@@ -14,6 +14,7 @@
 
 from aspen import Response
 
+from . import _requesting_asset
 from .crypto import constant_time_compare, get_random_string
 
 
@@ -37,7 +38,7 @@ def extract_token_from_cookie(request):
 
     # Don't set a CSRF cookie on assets, to avoid busting the cache.
 
-    if request.path.raw.startswith('/assets/'):
+    if _requesting_asset(request):
         token = None
     else:
         token = token or _get_new_token()

tests/py/test_security_csrf.py

@@ -48,5 +48,6 @@ def test_no_csrf_cookie_set_for_assets(self):
         r = self.client.GET('/assets/gratipay.css')
         assert b'csrf_token' not in r.headers.cookie
 
-    def test_that_missing_csrf_doesnt_confuse_whatever(self):
-        self.client.POST('/assets/gratipay.css')
+    def test_that_missing_csrf_on_assets_doesnt_result_in_a_500(self):
+        r = self.client.PxST('/assets/gratipay.css')
+        assert r.code == 405