awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-05 14:26:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: added validation for relay ip

Browse Source
This commit is contained in:
=
2025-02-26 20:45:38 +05:30
parent 46ca5c8efa
commit 55b1fbdf52
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/routes/v1/gateway-router.ts
+6 -1
View File
@@ -1,6 +1,7 @@
import { z } from "zod"; import { z } from "zod";
import { GatewaysSchema } from "@app/db/schemas"; import { GatewaysSchema } from "@app/db/schemas";
import { isValidIp } from "@app/lib/ip";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { slugSchema } from "@app/server/lib/schemas"; import { slugSchema } from "@app/server/lib/schemas";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -16,6 +17,10 @@ const SanitizedGatewaySchema = GatewaysSchema.pick({
serialNumber: true, serialNumber: true,
heartbeat: true heartbeat: true
}); });
const isValidRelayAddress = (relayAddress: string) => {
const [ip, port] = relayAddress.split(":");
return isValidIp(ip) && Number(port) <= 65535 && Number(port) >= 49152;
};
export const registerGatewayRouter = async (server: FastifyZodProvider) => { export const registerGatewayRouter = async (server: FastifyZodProvider) => {
server.route({ server.route({
@@ -54,7 +59,7 @@ export const registerGatewayRouter = async (server: FastifyZodProvider) => {
}, },
schema: { schema: {
body: z.object({ body: z.object({
relayAddress: z.string() relayAddress: z.string().refine(isValidRelayAddress, { message: "Invalid relay address" })
}), }),
response: { response: {
200: z.object({ 200: z.object({
backend/src/ee/services/gateway/gateway-service.ts
+2 -1
View File
@@ -353,7 +353,7 @@ export const gatewayServiceFactory = ({
), ),
new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.SERVER_AUTH]], true), new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.SERVER_AUTH]], true),
// san // san
new x509.SubjectAlternativeNameExtension([{ type: "ip", value: "127.0.0.1" }], false) new x509.SubjectAlternativeNameExtension([{ type: "ip", value: relayAddress.split(":")[0] }], false)
]; ];
const serialNumber = createSerialNumber(); const serialNumber = createSerialNumber();
@@ -374,6 +374,7 @@ export const gatewayServiceFactory = ({
// just for local development // just for local development
const formatedRelayAddress = const formatedRelayAddress =
appCfg.NODE_ENV === "development" ? relayAddress.replace("127.0.0.1", "host.docker.internal") : relayAddress; appCfg.NODE_ENV === "development" ? relayAddress.replace("127.0.0.1", "host.docker.internal") : relayAddress;
await gatewayDAL.transaction(async (tx) => { await gatewayDAL.transaction(async (tx) => {
await tx.raw("SELECT pg_advisory_xact_lock(?)", [PgSqlLock.OrgGatewayCertExchange(identityOrg)]); await tx.raw("SELECT pg_advisory_xact_lock(?)", [PgSqlLock.OrgGatewayCertExchange(identityOrg)]);
const existingGateway = await gatewayDAL.findOne({ identityId, orgGatewayRootCaId: orgGatewayConfig.id }); const existingGateway = await gatewayDAL.findOne({ identityId, orgGatewayRootCaId: orgGatewayConfig.id });