3e13f31 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Ensure that cookie names over 256 characters are rejected by validation

commit3e13f3197f0628110f525e8b454e7f1d142452a3 authorJoel Speed <joel.speed@hotmail.co.uk> dateSat 4 Jul 2020, 16:08 (6 years ago) parenteb933cc

2 files changed+31−2

compare with master

unifiedsplit

pkg/validation/cookie.go+8−2 pkg/validation/cookie_test.go+23

pkg/validation/cookie.go+8−2

@@ -35,11 +35,17 @@ func validateCookie(o options.Cookie) []string {

3535}

3636

3737func validateCookieName(name string) []string {

38+ msgs := []string{}

39+

3840 cookie := &http.Cookie{Name: name}

3941 if cookie.String() == "" {

40− return []string{fmt.Sprintf("invalid cookie name: %q", name)}

42+ msgs = append(msgs, fmt.Sprintf("invalid cookie name: %q", name))

43+ }

44+

45+ if len(name) > 256 {

46+ msgs = append(msgs, fmt.Sprintf("cookie name should be under 256 characters: cookie name is %d characters", len(name)))

4147 }

42− return []string{}

48+ return msgs

4349}

4450

4551func validateCookieSecret(secret string) []string {

pkg/validation/cookie_test.go+23

@@ -1,6 +1,7 @@

11package validation

33import (

4+ "strings"

45 "testing"

56 "time"

@@ -9,8 +10,12 @@ import (

910)

1011

1112func TestValidateCookie(t *testing.T) {

13+ alphabet := "abcdefghijklmnopqrstuvwxyz"

14+

1215 validName := "_oauth2_proxy"

1316 invalidName := "_oauth2;proxy" // Separater character not allowed

17+ // 10 times the alphabet should be longer than 256 characters

18+ longName := strings.Repeat(alphabet, 10)

1419 validSecret := "secretthirtytwobytes+abcdefghijk"

1520 invalidSecret := "abcdef" // 6 bytes is not a valid size

1621 validBase64Secret := "c2VjcmV0dGhpcnR5dHdvYnl0ZXMrYWJjZGVmZ2hpams" // Base64 encoding of "secretthirtytwobytes+abcdefghijk"

@@ -25,6 +30,7 @@ func TestValidateCookie(t *testing.T) {

2530 }

2631

2732 invalidNameMsg := "invalid cookie name: \"_oauth2;proxy\""

33+ longNameMsg := "cookie name should be under 256 characters: cookie name is 260 characters"

2834 missingSecretMsg := "missing setting: cookie-secret"

2935 invalidSecretMsg := "cookie_secret must be 16, 24, or 32 bytes to create an AES cipher, but is 6 bytes"

3036 invalidBase64SecretMsg := "cookie_secret must be 16, 24, or 32 bytes to create an AES cipher, but is 10 bytes"

@@ -134,6 +140,23 @@ func TestValidateCookie(t *testing.T) {

134140 invalidNameMsg,

135141 },

136142 },

143+ {

144+ name: "with a name that is too long",

145+ cookie: options.Cookie{

146+ Name: longName,

147+ Secret: validSecret,

148+ Domains: emptyDomains,

149+ Path: "",

150+ Expire: time.Hour,

151+ Refresh: 15 * time.Minute,

152+ Secure: true,

153+ HTTPOnly: false,

154+ SameSite: "",

155+ },

156+ errStrings: []string{

157+ longNameMsg,

158+ },

159+ },

137160 {

138161 name: "with refresh longer than expire",

139162 cookie: options.Cookie{