Backwards Compatible Fix for CVE-2024-6221

[adrianosela]

Backwards Compatible Fix for CVE-2024-6221

Also tracked as:

• SNYK-PYTHON-FLASKCORS-7707876
• GHSA-hxwh-jpp2-84pm

Adds a configuration option that allows setting a custom true/false value in the response header Access-Control-Allow-Private-Network (whenever the request header Access-Control-Request-Private-Network is present and "true")

The default behavior is unchanged, allowing this change to go in as a new minor version.

However, the wording of the CVE implies that the default behavior should be changed to set the header to "false" unless setting to "true" is explicitly enabled.

Making that change means simply changing the allow_private_network=True to allow_private_network=False in the options list. This would require cutting a new major version (5.0.0) for flask-cors.

[alexgokhale]

Original issue highlighting this vulnerability: #337

@corydolphin It would be great if you could allow this change to be merged, and as mentioned in #337 it would be ideal if this was not the default behaviour (which would presumably require a major version bump to v5.0.0).

Thanks in advance!

[Alex-ley-scrub]

if anyone is looking for a temporary fix before this gets released:

app = Flask(__name__)

def set_allow_private_network_false(response: Response):
    """Set the private network header to false to temporarily fix unpatched vulnerability found in Flask-CORS"""
    # https://github.com/advisories/GHSA-hxwh-jpp2-84pm/
    # https://github.com/corydolphin/flask-cors/pull/363
    if "Access-Control-Allow-Private-Network" in response.headers:
        response.headers["Access-Control-Allow-Private-Network"] = "false"
    return response
    
app.after_request(set_allow_private_network_false)

[corydolphin]

Thank you very much for the contribution @adrianosela and @alexgokhale, apologies for my slowness in reviewing it. Contributions like this make supporting this package possible.

I'm going to merge this as is, and then adjust the defaults to exclude private networks.

[Alex-ley-scrub]

I requested for the GitHub advisory database to be updated since it is now fixed: github/advisory-database#4749