git.iko.soy/typeable/oauth2-proxy
on master help sign in
Update golangci-lint version in CI workflow
commit9cea4ea89b2ede265111fe6a1985f81fd2d41dc3 authorJoel Speed <joel.speed@hotmail.co.uk> dateWed 17 Feb 2021, 20:15 (6 years ago) parent76269a1
7 files changed+23−13
compare with master
unifiedsplit
.github/workflows/ci.yaml+3−3 CHANGELOG.md+1 oauthproxy.go+4−2 pkg/validation/options.go+4−4 providers/logingov.go+9−2 providers/provider_default.go+1−1 providers/providers.go+1−1
.github/workflows/ci.yaml+3−3
@@ -14,7 +14,7 @@ jobs:
1414 build:
1515 env:
1616 COVER: true
17− runs-on: ubuntu-18.04
17+ runs-on: ubuntu-20.04
1818 steps:
1919
2020 - name: Check out code
@@ -28,7 +28,7 @@ jobs:
2828
2929 - name: Get dependencies
3030 run: |
31− curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.24.0
31+ curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.36.0
3232 go mod download
3333 curl -L https://codeclimate.com/downloads/test-reporter/test-reporter-latest-linux-amd64 > ./cc-test-reporter
3434 chmod +x ./cc-test-reporter
@@ -52,7 +52,7 @@ jobs:
5252 ./.github/workflows/test.sh
5353
5454 docker:
55− runs-on: ubuntu-18.04
55+ runs-on: ubuntu-20.04
5656 steps:
5757
5858 - name: Check out code
CHANGELOG.md+1
@@ -8,6 +8,7 @@
88
99## Changes since v7.0.1
1010
11+- [#1052](https://github.com/oauth2-proxy/oauth2-proxy/pull/1052) Update golangci-lint to latest version (v1.36.0) (@JoelSpeed)
1112- [#1043](https://github.com/oauth2-proxy/oauth2-proxy/pull/1043) Refactor Sign In Page rendering and capture all page rendering code in pagewriter package (@JoelSpeed)
1213- [#1029](https://github.com/oauth2-proxy/oauth2-proxy/pull/1029) Refactor error page rendering and allow debug messages on error (@JoelSpeed)
1314- [#1028](https://github.com/oauth2-proxy/oauth2-proxy/pull/1028) Refactor templates, update theme and provide styled error pages (@JoelSpeed)
oauthproxy.go+4−2
@@ -641,7 +641,7 @@ func (p *OAuthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {
641641 }
642642}
643643
644−//UserInfo endpoint outputs session email and preferred username in JSON format
644+// UserInfo endpoint outputs session email and preferred username in JSON format
645645func (p *OAuthProxy) UserInfo(rw http.ResponseWriter, req *http.Request) {
646646
647647 session, err := p.getAuthenticatedSession(rw, req)
@@ -805,6 +805,8 @@ func (p *OAuthProxy) redeemCode(req *http.Request) (*sessionsapi.SessionState, e
805805func (p *OAuthProxy) enrichSessionState(ctx context.Context, s *sessionsapi.SessionState) error {
806806 var err error
807807 if s.Email == "" {
808+ // TODO(@NickMeves): Remove once all provider are updated to implement EnrichSession
809+ // nolint:staticcheck
808810 s.Email, err = p.provider.GetEmailAddress(ctx, s)
809811 if err != nil && !errors.Is(err, providers.ErrNotImplemented) {
810812 return err
@@ -1106,7 +1108,7 @@ func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.R
11061108// TODO (@NickMeves): This method is a placeholder to be extended but currently
11071109// fails the linter. Remove the nolint when functionality expands.
11081110//
1109−//nolint:S1008
1111+//nolint:gosimple
11101112func authOnlyAuthorize(req *http.Request, s *sessionsapi.SessionState) bool {
11111113 // Allow secondary group restrictions based on the `allowed_groups`
11121114 // querystring parameter
pkg/validation/options.go+4−4
@@ -41,10 +41,10 @@ func Validate(o *options.Options) error {
4141 } else if len(o.ProviderCAFiles) > 0 {
4242 pool, err := util.GetCertPool(o.ProviderCAFiles)
4343 if err == nil {
44− transport := &http.Transport{
45− TLSClientConfig: &tls.Config{
46− RootCAs: pool,
47− },
44+ transport := http.DefaultTransport.(*http.Transport).Clone()
45+ transport.TLSClientConfig = &tls.Config{
46+ RootCAs: pool,
47+ MinVersion: tls.VersionTLS12,
4848 }
4949
5050 http.DefaultClient = &http.Client{Transport: transport}
providers/logingov.go+9−2
@@ -3,9 +3,10 @@ package providers
33import (
44 "bytes"
55 "context"
6+ "crypto/rand"
67 "crypto/rsa"
78 "fmt"
8− "math/rand"
9+ "math/big"
910 "net/url"
1011 "time"
1112
@@ -34,7 +35,13 @@ var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
3435func randSeq(n int) string {
3536 b := make([]rune, n)
3637 for i := range b {
37− b[i] = letters[rand.Intn(len(letters))]
38+ max := big.NewInt(int64(len(letters)))
39+ bigN, err := rand.Int(rand.Reader, max)
40+ if err != nil {
41+ // This should never happen
42+ panic(err)
43+ }
44+ b[i] = letters[bigN.Int64()]
3845 }
3946 return string(b)
4047}
providers/provider_default.go+1−1
@@ -94,7 +94,7 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {
9494}
9595
9696// GetEmailAddress returns the Account email address
97−// DEPRECATED: Migrate to EnrichSession
97+// Deprecated: Migrate to EnrichSession
9898func (p *ProviderData) GetEmailAddress(_ context.Context, _ *sessions.SessionState) (string, error) {
9999 return "", ErrNotImplemented
100100}
providers/providers.go+1−1
@@ -9,7 +9,7 @@ import (
99// Provider represents an upstream identity provider implementation
1010type Provider interface {
1111 Data() *ProviderData
12− // DEPRECATED: Migrate to EnrichSession
12+ // Deprecated: Migrate to EnrichSession
1313 GetEmailAddress(ctx context.Context, s *sessions.SessionState) (string, error)
1414 Redeem(ctx context.Context, redirectURI, code string) (*sessions.SessionState, error)
1515 EnrichSession(ctx context.Context, s *sessions.SessionState) error