awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: added validation for relay ip

Browse Source
This commit is contained in:
=
2025-02-21 00:20:52 +05:30
parent 46ca5c8efa
commit 55b1fbdf52
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
backend/src/ee/routes/v1/gateway-router.ts
View File

@@ -1,6 +1,7 @@
import { z } from "zod";
import { GatewaysSchema } from "@app/db/schemas";
import { isValidIp } from "@app/lib/ip";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { slugSchema } from "@app/server/lib/schemas";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -16,6 +17,10 @@ const SanitizedGatewaySchema = GatewaysSchema.pick({
serialNumber: true,
heartbeat: true
});
const isValidRelayAddress = (relayAddress: string) => {
const [ip, port] = relayAddress.split(":");
return isValidIp(ip) && Number(port) <= 65535 && Number(port) >= 49152;
};
export const registerGatewayRouter = async (server: FastifyZodProvider) => {
server.route({
@@ -54,7 +59,7 @@ export const registerGatewayRouter = async (server: FastifyZodProvider) => {
},
schema: {
body: z.object({
relayAddress: z.string()
relayAddress: z.string().refine(isValidRelayAddress, { message: "Invalid relay address" })
}),
response: {
200: z.object({

3
backend/src/ee/services/gateway/gateway-service.ts
View File

@@ -353,7 +353,7 @@ export const gatewayServiceFactory = ({
),
new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.SERVER_AUTH]], true),
// san
new x509.SubjectAlternativeNameExtension([{ type: "ip", value: "127.0.0.1" }], false)
new x509.SubjectAlternativeNameExtension([{ type: "ip", value: relayAddress.split(":")[0] }], false)
];
const serialNumber = createSerialNumber();
@@ -374,6 +374,7 @@ export const gatewayServiceFactory = ({
// just for local development
const formatedRelayAddress =
appCfg.NODE_ENV === "development" ? relayAddress.replace("127.0.0.1", "host.docker.internal") : relayAddress;
await gatewayDAL.transaction(async (tx) => {
await tx.raw("SELECT pg_advisory_xact_lock(?)", [PgSqlLock.OrgGatewayCertExchange(identityOrg)]);
const existingGateway = await gatewayDAL.findOne({ identityId, orgGatewayRootCaId: orgGatewayConfig.id });