43596a7 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

Merge commit from fork

43596a7Jan Larwig6 months ago

CHANGELOG.md+1

compare with master

unifiedsplit

@@ -11,6 +11,7 @@

11- [#3411](https://github.com/oauth2-proxy/oauth2-proxy/pull/3411) chore(deps): update gomod dependencies (@tuunit)

12- [#3333](https://github.com/oauth2-proxy/oauth2-proxy/pull/3333) fix: invalidate session on fatal OAuth2 refresh errors (@frhack)

13- [GHSA-f24x-5g9q-753f](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-f24x-5g9q-753f) fix: clear session cookie at beginning of signinpage handler (@fnoehWM / @bella-WI / @tuunit)

14+- [GHSA-5hvv-m4w4-gf6v](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v) fix: health check user-agent authentication bypass (@tuunit)

15# V7.15.1

16# V7.15.1

pkg/middleware/healthcheck.go+7−4

@@ -43,10 +43,13 @@ func healthCheck(paths, userAgents []string, next http.Handler) http.Handler {

44func isHealthCheckRequest(paths, userAgents map[string]struct{}, req *http.Request) bool {

45 if _, ok := paths[req.URL.EscapedPath()]; ok {

46+ if len(userAgents) == 0 {

46− return true

47+ return true

47− }

48+ }

49+

48− if _, ok := userAgents[req.Header.Get("User-Agent")]; ok {

50+ if _, ok := userAgents[req.Header.Get("User-Agent")]; ok {

49− return true

51+ return true

52+ }

50 }

53 }

51 return false

54 return false

52}

55}

pkg/middleware/healthcheck_test.go+31−9

@@ -45,6 +45,16 @@ var _ = Describe("HealthCheck suite", func() {

45 healthCheckPaths: []string{"/ping"},

46 healthCheckUserAgents: []string{"hc/1.0"},

47 requestString: "http://example.com/ping",

48+ headers: map[string]string{

49+ "User-Agent": "hc/1.0",

50+ },

51+ expectedStatus: 200,

52+ expectedBody: "OK",

53+ }),

54+ Entry("when requesting the healthcheck path with no health check user agents configured", &requestTableInput{

55+ healthCheckPaths: []string{"/ping"},

56+ healthCheckUserAgents: []string{},

57+ requestString: "http://example.com/ping",

48 headers: map[string]string{},

58 headers: map[string]string{},

49 expectedStatus: 200,

59 expectedStatus: 200,

50 expectedBody: "OK",

60 expectedBody: "OK",

@@ -85,15 +95,25 @@ var _ = Describe("HealthCheck suite", func() {

85 expectedStatus: 404,

95 expectedStatus: 404,

86 expectedBody: "404 page not found\n",

96 expectedBody: "404 page not found\n",

87 }),

97 }),

88− Entry("with a request from the health check user agent", &requestTableInput{

98+ Entry("with a request from the health check user agent on a non-healthcheck path", &requestTableInput{

89 healthCheckPaths: []string{"/ping"},

99 healthCheckPaths: []string{"/ping"},

90 healthCheckUserAgents: []string{"hc/1.0"},

100 healthCheckUserAgents: []string{"hc/1.0"},

91 requestString: "http://example.com/abc",

101 requestString: "http://example.com/abc",

92 headers: map[string]string{

102 headers: map[string]string{

93 "User-Agent": "hc/1.0",

103 "User-Agent": "hc/1.0",

94 },

104 },

95− expectedStatus: 200,

105+ expectedStatus: 404,

96− expectedBody: "OK",

106+ expectedBody: "404 page not found\n",

107+ }),

108+ Entry("when an auth_request endpoint receives the configured health check user agent", &requestTableInput{

109+ healthCheckPaths: []string{"/ping"},

110+ healthCheckUserAgents: []string{"GoogleHC/1.0"},

111+ requestString: "http://example.com/oauth2/auth",

112+ headers: map[string]string{

113+ "User-Agent": "GoogleHC/1.0",

114+ },

115+ expectedStatus: 404,

116+ expectedBody: "404 page not found\n",

97 }),

117 }),

98 Entry("when a blank string is configured as a health check agent and a request has no user agent", &requestTableInput{

118 Entry("when a blank string is configured as a health check agent and a request has no user agent", &requestTableInput{

99 healthCheckPaths: []string{"/ping"},

119 healthCheckPaths: []string{"/ping"},

@@ -107,9 +127,11 @@ var _ = Describe("HealthCheck suite", func() {

107 healthCheckPaths: []string{"/ping", "/liveness_check", "/readiness_check"},

127 healthCheckPaths: []string{"/ping", "/liveness_check", "/readiness_check"},

108 healthCheckUserAgents: []string{"hc/1.0"},

128 healthCheckUserAgents: []string{"hc/1.0"},

109 requestString: "http://example.com/readiness_check",

129 requestString: "http://example.com/readiness_check",

110− headers: map[string]string{},

130+ headers: map[string]string{

131+ "User-Agent": "hc/1.0",

132+ },

111− expectedStatus: 200,

133+ expectedStatus: 200,

112− expectedBody: "OK",

134+ expectedBody: "OK",

113 }),

135 }),

114 Entry("with multiple paths, request none of the healthcheck paths", &requestTableInput{

136 Entry("with multiple paths, request none of the healthcheck paths", &requestTableInput{

115 healthCheckPaths: []string{"/ping", "/liveness_check", "/readiness_check"},

137 healthCheckPaths: []string{"/ping", "/liveness_check", "/readiness_check"},

@@ -121,15 +143,15 @@ var _ = Describe("HealthCheck suite", func() {

121 expectedStatus: 404,

143 expectedStatus: 404,

122 expectedBody: "404 page not found\n",

144 expectedBody: "404 page not found\n",

123 }),

145 }),

124− Entry("with multiple user agents, request from a health check user agent", &requestTableInput{

146+ Entry("with multiple user agents, request from a health check user agent on a non-healthcheck path", &requestTableInput{

125 healthCheckPaths: []string{"/ping"},

147 healthCheckPaths: []string{"/ping"},

126 healthCheckUserAgents: []string{"hc/1.0", "GoogleHC/1.0"},

148 healthCheckUserAgents: []string{"hc/1.0", "GoogleHC/1.0"},

127 requestString: "http://example.com/abc",

149 requestString: "http://example.com/abc",

128 headers: map[string]string{

150 headers: map[string]string{

129 "User-Agent": "GoogleHC/1.0",

151 "User-Agent": "GoogleHC/1.0",

130 },

152 },

131− expectedStatus: 200,

153+ expectedStatus: 404,

132− expectedBody: "OK",

154+ expectedBody: "404 page not found\n",

133 }),

155 }),

134 Entry("with multiple user agents, request from none of the health check user agents", &requestTableInput{

156 Entry("with multiple user agents, request from none of the health check user agents", &requestTableInput{

135 healthCheckPaths: []string{"/ping"},

157 healthCheckPaths: []string{"/ping"},