git.iko.soy/typeable/oauth2-proxy
on master help sign in
Bugfix/check json path (#1921)

* Validate jsonpath in claim extractor Signed-off-by: Joseph Weigl <joseph.weigl@audi.de> * Add test and changelog for claim extractor json path --------- Signed-off-by: Joseph Weigl <joseph.weigl@audi.de> Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

commitbd867b5138a2152f411a00c822ef475740215ad1 authorJoseph Weigl <joseph.weigl@audi.de> dateThu 24 Aug 2023, 14:40 (3 years ago) parentd9b9bcf
5 files changed+26−1
compare with master
unifiedsplit
CHANGELOG.md+1 go.mod+1 go.sum+2 pkg/providers/util/claim_extractor.go+6−1 pkg/providers/util/claim_extractor_test.go+16
CHANGELOG.md+1
@@ -22,6 +22,7 @@
2222- [#1988](https://github.com/oauth2-proxy/oauth2-proxy/pull/1988) Ensure sign-in page background is uniform throughout the page
2323- [#2013](https://github.com/oauth2-proxy/oauth2-proxy/pull/2013) Upgrade alpine to version 3.17.2 and library dependencies (@miguelborges99)
2424- [#2047](https://github.com/oauth2-proxy/oauth2-proxy/pull/2047) CVE-2022-41717: DoS in Go net/http may lead to DoS (@miguelborges99)
25+- [#1921](https://github.com/oauth2-proxy/oauth2-proxy/pull/1921) Check jsonpath syntax before interpretation
2526
2627# V7.4.0
2728
go.mod+1
@@ -19,6 +19,7 @@ require (
1919 github.com/mitchellh/mapstructure v1.1.2
2020 github.com/oauth2-proxy/mockoidc v0.0.0-20220221072942-e3afe97dec43
2121 github.com/oauth2-proxy/tools/reference-gen v0.0.0-20210118095127-56ffd7384404
22+ github.com/ohler55/ojg v1.14.5
2223 github.com/onsi/ginkgo v1.16.5
2324 github.com/onsi/gomega v1.27.6
2425 github.com/pierrec/lz4/v4 v4.1.17
go.sum+2
@@ -269,6 +269,8 @@ github.com/oauth2-proxy/mockoidc v0.0.0-20220221072942-e3afe97dec43 h1:V9YiO92tY
269269github.com/oauth2-proxy/mockoidc v0.0.0-20220221072942-e3afe97dec43/go.mod h1:rW25Kyd08Wdn3UVn0YBsDTSvReu0jqpmJKzxITPSjks=
270270github.com/oauth2-proxy/tools/reference-gen v0.0.0-20210118095127-56ffd7384404 h1:ZpzR4Ou1nhldBG/vEzauoqyaUlofaUcLkv1C/gBK8ls=
271271github.com/oauth2-proxy/tools/reference-gen v0.0.0-20210118095127-56ffd7384404/go.mod h1:YpORG8zs14vNlpXvuHYnnDvWazIRaDk02MaY8lafqdI=
272+github.com/ohler55/ojg v1.14.5 h1:xCX2oyh/ZaoesbLH6fwVHStSJpk4o4eJs8ttXutzdg0=
273+github.com/ohler55/ojg v1.14.5/go.mod h1:7Ghirupn8NC8hSSDpI0gcjorPxj+vSVIONDWfliHR1k=
272274github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
273275github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
274276github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
pkg/providers/util/claim_extractor.go+6−1
@@ -11,6 +11,7 @@ import (
1111
1212 "github.com/bitly/go-simplejson"
1313 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
14+ "github.com/ohler55/ojg/jp"
1415 "github.com/spf13/cast"
1516)
1617
@@ -139,9 +140,13 @@ func parseJWT(p string) ([]byte, error) {
139140}
140141
141142// getClaimFrom gets a claim from a Json object.
142−// It can accept either a single claim name or a json path.
143+// It can accept either a single claim name or a json path if the path is a valid json path.
143144// Paths with indexes are not supported.
144145func getClaimFrom(claim string, src *simplejson.Json) interface{} {
146+ _, err := jp.ParseString(claim)
147+ if err != nil {
148+ return src.Get(claim).Interface()
149+ }
145150 claimParts := strings.Split(claim, ".")
146151 return src.GetPath(claimParts...).Interface()
147152}
pkg/providers/util/claim_extractor_test.go+16
@@ -25,6 +25,10 @@ const (
2525 "groups": [
2626 "idTokenGroup1",
2727 "idTokenGroup2"
28+ ],
29+ "https://groups.test": [
30+ "fqdnGroup1",
31+ "fqdnGroup2"
2832 ]
2933 }`
3034 basicProfileURLPayload = `{
@@ -224,6 +228,18 @@ var _ = Describe("Claim Extractor Suite", func() {
224228 expectedValue: "nestedUser",
225229 expectedError: nil,
226230 }),
231+ Entry("retrieves claim for with FQDN", getClaimTableInput{
232+ testClaimExtractorOpts: testClaimExtractorOpts{
233+ idTokenPayload: basicIDTokenPayload,
234+ setProfileURL: true,
235+ profileRequestHeaders: newAuthorizedHeader(),
236+ profileRequestHandler: shouldNotBeRequestedProfileHandler,
237+ },
238+ claim: "https://groups.test",
239+ expectExists: true,
240+ expectedValue: []interface{}{"fqdnGroup1", "fqdnGroup2"},
241+ expectedError: nil,
242+ }),
227243 )
228244 })
229245