bdfde72 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merge commit from fork

Signed-off-by: Jan Larwig <jan@larwig.com>

commitbdfde725c6175a5b10e8b5ffe9f09159ea2db03c authorJan Larwig <jan@larwig.com> dateMon 13 Apr 2026, 18:29 (6 months ago) parentcc0e033

5 files changed+92−5

compare with master

unifiedsplit

CHANGELOG.md+1 docs/docs/configuration/overview.md+2−2 oauthproxy_test.go+52 pkg/requests/util/util.go+15−3 pkg/requests/util/util_test.go+22

CHANGELOG.md+1

@@ -14,6 +14,7 @@

1414- [GHSA-5hvv-m4w4-gf6v](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v) fix: health check user-agent authentication bypass (@tuunit)

1515- [GHSA-7x63-xv5r-3p2x](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x) fix: authentication bypass via X-Forwarded-Uri header spoofing (@tuunit)

1616- [GHSA-c5c4-8r6x-56w3](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-c5c4-8r6x-56w3) fix: email validation bypass via malformed multi-@ email claims (@tuunit)

17+- [GHSA-pxq7-h93f-9jrg](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg) fix: fragment evaluation as part of the allowed routes (@tuunit)

1718

1819# V7.15.1

1920

docs/docs/configuration/overview.md+2−2

@@ -218,8 +218,8 @@ When `--reverse-proxy` is enabled, configure `--trusted-proxy-ip` to the IPs or

218218| flag: `--trusted-proxy-ip` toml: `trusted_proxy_ips` | string \| list | list of IPs or CIDR ranges allowed to supply `X-Forwarded-*` headers when `--reverse-proxy` is enabled. If not set, OAuth2 Proxy preserves backwards compatibility by trusting all source IPs (`0.0.0.0/0`, `::/0`) and logs a warning at startup. Configure this to your reverse proxy addresses to prevent forwarded header spoofing. | `"0.0.0.0/0", "::/0"` |

222−| flag: `--skip-auth-route` toml: `skip_auth_routes` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex | |

221+| flag: `--skip-auth-regex` toml: `skip_auth_regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times). Path matching is performed against the normalized path only; fragment identifiers (`#`) and their URL-encoded form (`%23`) are stripped before evaluation. | |

222+| flag: `--skip-auth-route` toml: `skip_auth_routes` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex. Path matching is performed against the normalized path only; fragment identifiers (`#`) and their URL-encoded form (`%23`) are stripped before evaluation. | |

223223| flag: `--skip-jwt-bearer-tokens` toml: `skip_jwt_bearer_tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |

oauthproxy_test.go+52

@@ -2679,9 +2679,11 @@ func TestAllowedRequest(t *testing.T) {

26792679 }

26802680 opts.SkipAuthRegex = []string{

26812681 "^/skip/auth/regex$",

2682+ "^/public/.*/endpoint$",

26822683 }

26832684 opts.SkipAuthRoutes = []string{

26842685 "GET=^/skip/auth/routes/get",

2686+ "^/foo/.*/bar$",

26852687 }

26862688 err := validation.Validate(opts)

26872689 assert.NoError(t, err)

@@ -2714,6 +2716,18 @@ func TestAllowedRequest(t *testing.T) {

27142716 url: "/wrong/denied",

27152717 allowed: false,

27162718 },

2719+ {

2720+ name: "Regex allowed with fragment-free path",

2721+ method: "GET",

2722+ url: "/public/legit/endpoint",

2723+ allowed: true,

2724+ },

2725+ {

2726+ name: "Regex denied when path contains encoded fragment suffix",

2727+ method: "GET",

2728+ url: "/public/secret%23/endpoint",

2729+ allowed: false,

2730+ },

27172731 {

27182732 name: "Route allowed",

27192733 method: "GET",

@@ -2738,6 +2752,18 @@ func TestAllowedRequest(t *testing.T) {

27382752 url: "/skip/auth/routes/wrong/path",

27392753 allowed: false,

27402754 },

2755+ {

2756+ name: "Route allowed with fragment-free path",

2757+ method: "GET",

2758+ url: "/foo/public/bar",

2759+ allowed: true,

2760+ },

2761+ {

2762+ name: "Route denied when path contains encoded fragment suffix",

2763+ method: "GET",

2764+ url: "/foo/secret%23/bar",

2765+ allowed: false,

2766+ },

27412767 }

27422768

27432769 for _, tc := range testCases {

@@ -2778,9 +2804,11 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {

27782804 }

27792805 opts.SkipAuthRegex = []string{

27802806 "^/skip/auth/regex$",

2807+ "^/public/.*/endpoint$",

27812808 }

27822809 opts.SkipAuthRoutes = []string{

27832810 "GET=^/skip/auth/routes/get",

2811+ "^/foo/.*/bar$",

27842812 }

27852813 err := validation.Validate(opts)

27862814 assert.NoError(t, err)

@@ -2813,6 +2841,18 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {

28132841 url: "/wrong/denied",

28142842 allowed: false,

28152843 },

2844+ {

2845+ name: "Regex allowed with fragment-free path",

2846+ method: "GET",

2847+ url: "/public/legit/endpoint",

2848+ allowed: true,

2849+ },

2850+ {

2851+ name: "Regex denied when X-Forwarded-Uri contains an encoded fragment suffix",

2852+ method: "GET",

2853+ url: "/public/secret%23/endpoint",

2854+ allowed: false,

2855+ },

28162856 {

28172857 name: "Route allowed",

28182858 method: "GET",

@@ -2837,6 +2877,18 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {

28372877 url: "/skip/auth/routes/wrong/path",

28382878 allowed: false,

28392879 },

2880+ {

2881+ name: "Route allowed with fragment-free path",

2882+ method: "GET",

2883+ url: "/foo/public/bar",

2884+ allowed: true,

2885+ },

2886+ {

2887+ name: "Route denied when X-Forwarded-Uri contains an encoded fragment suffix",

2888+ method: "GET",

2889+ url: "/foo/secret%23/bar",

2890+ allowed: false,

2891+ },

28402892 }

28412893

28422894 for _, tc := range testCases {

pkg/requests/util/util.go+15−3

@@ -47,16 +47,28 @@ func GetRequestURI(req *http.Request) string {

4747

4848// GetRequestPath returns the request URI or X-Forwarded-Uri if present and the

4949// request came from a trusted reverse proxy but always strips the query

50−// parameters and only returns the pure path.

50+// parameters and fragment suffixes and only returns the pure path.

5151func GetRequestPath(req *http.Request) string {

52− uri := GetRequestURI(req)

52+ uri := stripRequestFragment(GetRequestURI(req))

5353

5454 // Parse URI and return only the path component

5555 if parsedURL, err := url.Parse(uri); err == nil {

56− return parsedURL.Path

56+ return stripRequestFragment(parsedURL.Path)

5757 }

5858

5959 // Fallback: strip query parameters manually

60+ return stripRequestQuery(uri)

61+}

62+

63+func stripRequestFragment(uri string) string {

64+ if idx := strings.Index(uri, "#"); idx != -1 {

65+ return uri[:idx]

66+ }

67+

68+ return uri

69+}

70+

71+func stripRequestQuery(uri string) string {

6072 if idx := strings.Index(uri, "?"); idx != -1 {

6173 return uri[:idx]

6274 }

pkg/requests/util/util_test.go+22

@@ -152,6 +152,23 @@ var _ = Describe("Util Suite", func() {

152152 Expect(util.GetRequestPath(req)).To(Equal(uriNoQueryParams))

153153 })

154154

155+ It("drops fragment content from a parsed request path", func() {

156+ // Simulate net/http ParseRequestURI preserving '#' in URL.Path.

157+ req.URL.Path = "/foo/secret#/bar"

158+ req.URL.RawPath = "/foo/secret%23/bar"

159+ Expect(util.GetRequestPath(req)).To(Equal("/foo/secret"))

160+ })

161+

162+ It("drops fragment-like suffixes from encoded number signs", func() {

163+ req = httptest.NewRequest(

164+ http.MethodGet,

165+ fmt.Sprintf("%s://%s/foo/secret%%23/bar?query=param", proto, host),

166+ nil,

167+ )

168+ req = middleware.AddRequestScope(req, &middleware.RequestScope{})

169+ Expect(util.GetRequestPath(req)).To(Equal("/foo/secret"))

170+ })

171+

155172 It("ignores X-Forwarded-Uri and returns the URI (without query params)", func() {

156173 req.Header.Add("X-Forwarded-Uri", "/some/other/path?query=param")

157174 Expect(util.GetRequestPath(req)).To(Equal(uriNoQueryParams))

@@ -175,6 +192,11 @@ var _ = Describe("Util Suite", func() {

175192 req.Header.Add("X-Forwarded-Uri", "/some/other/path?query=param")

176193 Expect(util.GetRequestPath(req)).To(Equal("/some/other/path"))

177194 })

195+

196+ It("drops fragment-like suffixes from the X-Forwarded-Uri", func() {

197+ req.Header.Add("X-Forwarded-Uri", "/foo/secret%23/bar?query=param")

198+ Expect(util.GetRequestPath(req)).To(Equal("/foo/secret"))

199+ })

178200 })

179201 })

180202