8000 Sanitize nginx.com/jwt-token by haywoodsh · Pull Request #2774 · nginx/kubernetes-ingress · GitHub
[go: up one dir, main page]
Skip to content

Sanitize nginx.com/jwt-token #2774

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Jun 21, 2022
Merged

Sanitize nginx.com/jwt-token #2774

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
6b2eb67
add validation functions
haywoodsh Jun 10, 2022
9cf8c0f
validate jwt login url and add unit tests
haywoodsh Jun 14, 2022
5ab16f6
Remove unused code
haywoodsh Jun 14, 2022
4ac26a6
validate jwt token
haywoodsh Jun 16, 2022
17bdf8d
validate jwt token with regex
haywoodsh Jun 17, 2022
cc802ec
simplify regex
haywoodsh 8000 Jun 17, 2022
9d128a0
fix rebase and revert policy
haywoodsh Jun 17, 2022
58a3d46
Merge branch 'main' into validate-jwt-token-with-regex
shaun-nx Jun 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions internal/k8s/validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,16 +67,19 @@ const (
commaDelimiter = ","
annotationValueFmt = `([^"$\\]|\\[^$])*`
pathFmt = `/[^\s{};]*`
jwtTokenValueFmt = "\\$" + annotationValueFmt
)

const (
annotationValueFmtErrMsg = `a valid annotation value must have all '"' escaped and must not contain any '$' or end with an unescaped '\'`
pathErrMsg = "must start with / and must not include any whitespace character, `{`, `}` or `;`"
jwtTokenValueFmtErrMsg = `a valid annotation value must start with '$', have all '"' escaped, and must not contain any '$' or end with an unescaped '\'`
)

var (
validAnnotationValueRegex = regexp.MustCompile("^" + annotationValueFmt + "$")
pathRegexp = regexp.MustCompile("^" + pathFmt + "$")
pathRegexp = regexp.MustCompile("^" + pathFmt + "$")
validAnnotationValueRegex = regexp.MustCompile("^" + annotationValueFmt + "$")
validJWTTokenAnnotationValueRegex = regexp.MustCompile("^" + jwtTokenValueFmt + "$")
)

type annotationValidationContext struct {
Expand Down Expand Up @@ -222,6 +225,7 @@ var (
},
jwtTokenAnnotation: {
validatePlusOnlyAnnotation,
validateJWTTokenAnnotation,
},
jwtLoginURLAnnotation: {
validatePlusOnlyAnnotation,
Expand Down Expand Up @@ -339,6 +343,17 @@ func validateJWTRealm(context *annotationValidationContext) field.ErrorList {
return allErrs
}

func validateJWTTokenAnnotation(context *annotationValidationContext) field.ErrorList {
allErrs := field.ErrorList{}

if !validJWTTokenAnnotationValueRegex.MatchString(context.value) {
msg := validation.RegexError(jwtTokenValueFmtErrMsg, jwtTokenValueFmt, "$http_token", "$cookie_auth_token")
allErrs = append(allErrs, field.Invalid(context.fieldPath, context.value, msg))
}

return allErrs
}

func validateHTTPHeadersAnnotation(context *annotationValidationContext) field.ErrorList {
var allErrs field.ErrorList
headers := strings.Split(context.value, commaDelimiter)
Expand Down
69 changes: 69 additions & 0 deletions internal/k8s/validation_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1499,6 +1499,75 @@ func TestValidateNginxIngressAnnotations(t *testing.T) {
expectedErrors: nil,
msg: "valid nginx.com/jwt-token annotation",
},
{
annotations: map[string]string{
"nginx.com/jwt-token": "cookie_auth_token",
},
specServices: map[string]bool{},
isPlus: true,
appProtectEnabled: false,
appProtectDosEnabled: false,
internalRoutesEnabled: false,
expectedErrors: []string{
"annotations.nginx.com/jwt-token: Invalid value: \"cookie_auth_token\": a valid annotation value must start with '$', have all '\"' escaped, and must not contain any '$' or end with an unescaped '\\' (e.g. '$http_token', or '$cookie_auth_token', regex used for validation is '\\$([^\"$\\\\]|\\\\[^$])*')",
}, msg: "invalid nginx.com/jwt-token annotation, '$' missing",
},
{
annotations: map[string]string{
"nginx.com/jwt-token": `$cookie_auth_token"`,
},
specServices: map[string]bool{},
isPlus: true,
appProtectEnabled: false,
appProtectDosEnabled: false,
internalRoutesEnabled: false,
expectedErrors: []string{
"annotations.nginx.com/jwt-token: Invalid value: \"$cookie_auth_token\\\"\": a valid annotation value must start with '$', have all '\"' escaped, and must not contain any '$' or end with an unescaped '\\' (e.g. '$http_token', or '$cookie_auth_token', regex used for validation is '\\$([^\"$\\\\]|\\\\[^$])*')",
},
msg: "invalid nginx.com/jwt-token annotation, containing unescaped '\"'",
},
{
annotations: map[string]string{
"nginx.com/jwt-token": `$cookie_auth_token\`,
},
sp 9E12 ecServices: map[string]bool{},
isPlus: true,
appProtectEnabled: false,
appProtectDosEnabled: false,
internalRoutesEnabled: false,
expectedErrors: []string{
"annotations.nginx.com/jwt-token: Invalid value: \"$cookie_auth_token\\\\\": a valid annotation value must start with '$', have all '\"' escaped, and must not contain any '$' or end with an unescaped '\\' (e.g. '$http_token', or '$cookie_auth_token', regex used for validation is '\\$([^\"$\\\\]|\\\\[^$])*')",
},
msg: "invalid nginx.com/jwt-token annotation, containing escape characters",
},
{
annotations: map[string]string{
"nginx.com/jwt-token": "cookie_auth$token",
},
specServices: map[string]bool{},
isPlus: true,
appProtectEnabled: false,
appProtectDosEnabled: false,
internalRoutesEnabled: false,
expectedErrors: []string{
"annotations.nginx.com/jwt-token: Invalid value: \"cookie_auth$token\": a valid annotation value must start with '$', have all '\"' escaped, and must not contain any '$' or end with an unescaped '\\' (e.g. '$http_token', or '$cookie_auth_token', regex used for validation is '\\$([^\"$\\\\]|\\\\[^$])*')",
},
msg: "invalid nginx.com/jwt-token annotation, containing incorrect variable",
},
{
annotations: map[string]string{
"nginx.com/jwt-token": "$cookie_auth_token$http_token",
},
specServices: map[string]bool{},
isPlus: true,
appProtectEnabled: false,
appProtectDosEnabled: false,
internalRoutesEnabled: false,
expectedErrors: []string{
"annotations.nginx.com/jwt-token: Invalid value: \"$cookie_auth_token$http_token\": a valid annotation value must start with '$', have all '\"' escaped, and must not contain any '$' or end with an unescaped '\\' (e.g. '$http_token', or '$cookie_auth_token', regex used for validation is '\\$([^\"$\\\\]|\\\\[^$])*')",
},
msg: "invalid nginx.com/jwt-token annotation, containing more than 1 variable",
},

{
annotations: map[string]string{
Expand Down
0