5b003a5 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

SecretSource.Value should be plain text in memory

commit5b003a5657c7fdc489d2a2b3e05e25424be22fc2 authorJoel Speed <joel.speed@hotmail.co.uk> dateThu 19 Nov 2020, 19:58 (6 years ago) parentd587030

9 files changed+20−52

compare with master

unifiedsplit

oauthproxy_test.go+2−2 pkg/apis/options/legacy_options.go+1−2 pkg/apis/options/legacy_options_test.go+2−3 pkg/apis/options/util/util.go+1−4 pkg/apis/options/util/util_test.go+3−12 pkg/header/injector_test.go+7−7 pkg/validation/common.go+1−10 pkg/validation/common_test.go+1−10 pkg/validation/header_test.go+2−2

oauthproxy_test.go+2−2

@@ -515,7 +515,7 @@ func TestBasicAuthPassword(t *testing.T) {

515515 ClaimSource: &options.ClaimSource{

516516 Claim: "email",

517517 BasicAuthPassword: &options.SecretSource{

518− Value: []byte(base64.StdEncoding.EncodeToString([]byte(basicAuthPassword))),

518+ Value: []byte(basicAuthPassword),

519519 },

520520 },

521521 },

@@ -1408,7 +1408,7 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {

14081408 ClaimSource: &options.ClaimSource{

14091409 Claim: "user",

14101410 BasicAuthPassword: &options.SecretSource{

1411− Value: []byte(base64.StdEncoding.EncodeToString([]byte("This is a secure password"))),

1411+ Value: []byte("This is a secure password"),

14121412 },

14131413 },

14141414 },

pkg/apis/options/legacy_options.go+1−2

@@ -1,7 +1,6 @@

11package options

33import (

4− "encoding/base64"

54 "fmt"

65 "net/url"

76 "strconv"

@@ -235,7 +234,7 @@ func getBasicAuthHeader(preferEmailToUser bool, basicAuthPassword string) Header

235234 Claim: claim,

236235 Prefix: "Basic ",

237236 BasicAuthPassword: &SecretSource{

238− Value: []byte(base64.StdEncoding.EncodeToString([]byte(basicAuthPassword))),

237+ Value: []byte(basicAuthPassword),

239238 },

240239 },

241240 },

pkg/apis/options/legacy_options_test.go+2−3

@@ -1,7 +1,6 @@

11package options

33import (

4− "encoding/base64"

54 "time"

76 . "github.com/onsi/ginkgo"

@@ -332,7 +331,7 @@ var _ = Describe("Legacy Options", func() {

332331 Claim: "user",

333332 Prefix: "Basic ",

334333 BasicAuthPassword: &SecretSource{

335− Value: []byte(base64.StdEncoding.EncodeToString([]byte(basicAuthSecret))),

334+ Value: []byte(basicAuthSecret),

336335 },

337336 },

338337 },

@@ -372,7 +371,7 @@ var _ = Describe("Legacy Options", func() {

372371 Claim: "email",

373372 Prefix: "Basic ",

374373 BasicAuthPassword: &SecretSource{

375− Value: []byte(base64.StdEncoding.EncodeToString([]byte(basicAuthSecret))),

374+ Value: []byte(basicAuthSecret),

376375 },

377376 },

378377 },

pkg/apis/options/util/util.go+1−4

@@ -1,7 +1,6 @@

11package util

33import (

4− "encoding/base64"

54 "errors"

65 "io/ioutil"

76 "os"

@@ -13,9 +12,7 @@ import (

1312func GetSecretValue(source *options.SecretSource) ([]byte, error) {

1413 switch {

1514 case len(source.Value) > 0 && source.FromEnv == "" && source.FromFile == "":

16− value := make([]byte, base64.StdEncoding.DecodedLen(len(source.Value)))

17− decoded, err := base64.StdEncoding.Decode(value, source.Value)

18− return value[:decoded], err

15+ return source.Value, nil

1916 case len(source.Value) == 0 && source.FromEnv != "" && source.FromFile == "":

2017 return []byte(os.Getenv(source.FromEnv)), nil

2118 case len(source.Value) == 0 && source.FromEnv == "" && source.FromFile != "":

pkg/apis/options/util/util_test.go+3−12

@@ -1,7 +1,6 @@

11package util

33import (

4− "encoding/base64"

54 "io/ioutil"

65 "os"

76 "path"

@@ -31,20 +30,12 @@ var _ = Describe("GetSecretValue", func() {

3130 os.RemoveAll(fileDir)

3231 })

3332

34− It("returns the correct value from base64", func() {

35− originalValue := []byte("secret-value-1")

36− b64Value := base64.StdEncoding.EncodeToString((originalValue))

37−

38− // Once encoded, the originalValue could have a decoded length longer than

39− // its actual length, ensure we trim this.

40− // This assertion ensures we are testing the triming

41− Expect(len(originalValue)).To(BeNumerically("<", base64.StdEncoding.DecodedLen(len(b64Value))))

42−

33+ It("returns the correct value from the string value", func() {

4334 value, err := GetSecretValue(&options.SecretSource{

44− Value: []byte(b64Value),

35+ Value: []byte("secret-value-1"),

4536 })

4637 Expect(err).ToNot(HaveOccurred())

47− Expect(value).To(Equal(originalValue))

38+ Expect(string(value)).To(Equal("secret-value-1"))

4839 })

4940

5041 It("returns the correct value from the environment", func() {

pkg/header/injector_test.go+7−7

@@ -49,14 +49,14 @@ var _ = Describe("Injector Suite", func() {

4949 },

5050 expectedErr: nil,

5151 }),

52− Entry("with a static valued header from base64", newInjectorTableInput{

52+ Entry("with a static valued header from string", newInjectorTableInput{

5353 headers: []options.Header{

5454 {

5555 Name: "Secret",

5656 Values: []options.HeaderValue{

5757 {

5858 SecretSource: &options.SecretSource{

59− Value: []byte(base64.StdEncoding.EncodeToString([]byte("super-secret"))),

59+ Value: []byte("super-secret"),

6060 },

6161 },

6262 },

@@ -200,7 +200,7 @@ var _ = Describe("Injector Suite", func() {

200200 ClaimSource: &options.ClaimSource{

201201 Claim: "user",

202202 BasicAuthPassword: &options.SecretSource{

203− Value: []byte(base64.StdEncoding.EncodeToString([]byte("basic-password"))),

203+ Value: []byte("basic-password"),

204204 },

205205 },

206206 },

@@ -349,7 +349,7 @@ var _ = Describe("Injector Suite", func() {

349349 ClaimSource: &options.ClaimSource{

350350 Claim: "user",

351351 BasicAuthPassword: &options.SecretSource{

352− Value: []byte(base64.StdEncoding.EncodeToString([]byte("basic-password"))),

352+ Value: []byte("basic-password"),

353353 },

354354 },

355355 },

@@ -380,17 +380,17 @@ var _ = Describe("Injector Suite", func() {

380380 Values: []options.HeaderValue{

381381 {

382382 SecretSource: &options.SecretSource{

383− Value: []byte(base64.StdEncoding.EncodeToString([]byte("major=1"))),

383+ Value: []byte("major=1"),

384384 },

385385 },

386386 {

387387 SecretSource: &options.SecretSource{

388− Value: []byte(base64.StdEncoding.EncodeToString([]byte("minor=2"))),

388+ Value: []byte("minor=2"),

389389 },

390390 },

391391 {

392392 SecretSource: &options.SecretSource{

393− Value: []byte(base64.StdEncoding.EncodeToString([]byte("patch=3"))),

393+ Value: []byte("patch=3"),

394394 },

395395 },

396396 },

pkg/validation/common.go+1−10

@@ -1,7 +1,6 @@

11package validation

33import (

4− "encoding/base64"

54 "fmt"

65 "os"

@@ -13,7 +12,7 @@ const multipleValuesForSecretSource = "multiple values specified for secret sour

1312func validateSecretSource(source options.SecretSource) string {

1413 switch {

1514 case len(source.Value) > 0 && source.FromEnv == "" && source.FromFile == "":

16− return validateSecretSourceValue(source.Value)

15+ return ""

1716 case len(source.Value) == 0 && source.FromEnv != "" && source.FromFile == "":

1817 return validateSecretSourceEnv(source.FromEnv)

1918 case len(source.Value) == 0 && source.FromEnv == "" && source.FromFile != "":

@@ -23,14 +22,6 @@ func validateSecretSource(source options.SecretSource) string {

2322 }

2423}

2524

26−func validateSecretSourceValue(value []byte) string {

27− dst := make([]byte, len(value))

28− if _, err := base64.StdEncoding.Decode(dst, value); err != nil {

29− return fmt.Sprintf("error decoding secret value: %v", err)

30− }

31− return ""

32−}

33−

3425func validateSecretSourceEnv(key string) string {

3526 if value := os.Getenv(key); value == "" {

3627 return fmt.Sprintf("error loading secret from environent: no value for for key %q", key)

pkg/validation/common_test.go+1−10

@@ -1,7 +1,6 @@

11package validation

33import (

4− "encoding/base64"

54 "io/ioutil"

65 "os"

@@ -17,7 +16,7 @@ var _ = Describe("Common", func() {

1716 var validSecretSourceFile string

1817

1918 BeforeEach(func() {

20− validSecretSourceValue = []byte(base64.StdEncoding.EncodeToString([]byte("This is a secret source value")))

19+ validSecretSourceValue = []byte("This is a secret source value")

2120 Expect(os.Setenv(validSecretSourceEnv, "This is a secret source env")).To(Succeed())

2221 tmp, err := ioutil.TempFile("", "oauth2-proxy-secret-source-test")

2322 Expect(err).ToNot(HaveOccurred())

@@ -110,14 +109,6 @@ var _ = Describe("Common", func() {

110109 },

111110 expectedMsg: "",

112111 }),

113− Entry("with an invalid Value", validateSecretSourceTableInput{

114− source: func() options.SecretSource {

115− return options.SecretSource{

116− Value: []byte("Invalid Base64 Value"),

117− }

118− },

119− expectedMsg: "error decoding secret value: illegal base64 data at input byte 7",

120− }),

121112 Entry("with an invalid FromEnv", validateSecretSourceTableInput{

122113 source: func() options.SecretSource {

123114 return options.SecretSource{

pkg/validation/header_test.go+2−2

@@ -148,7 +148,7 @@ var _ = Describe("Headers", func() {

148148 ClaimSource: &options.ClaimSource{

149149 Claim: "user",

150150 BasicAuthPassword: &options.SecretSource{

151− Value: []byte("secret"),

151+ FromEnv: "UNKNOWN_ENV",

152152 },

153153 },

154154 },

@@ -157,7 +157,7 @@ var _ = Describe("Headers", func() {

157157 validHeader1,

158158 },

159159 expectedMsgs: []string{

160− "invalid header \"With-Invalid-Basic-Auth\": invalid values: invalid basicAuthPassword: error decoding secret value: illegal base64 data at input byte 4",

160+ "invalid header \"With-Invalid-Basic-Auth\": invalid values: invalid basicAuthPassword: error loading secret from environent: no value for for key \"UNKNOWN_ENV\"",

161161 },

162162 }),

163163 )