From 578a0d7d9320e494e3ae12107ba0705f6840d201 Mon Sep 17 00:00:00 2001 From: x032205 Date: Fri, 9 May 2025 02:54:49 -0400 Subject: [PATCH] review fixes --- .../identity-oci-auth/identity-oci-auth-service.ts | 10 +++++++++- .../identity-oci-auth/identity-oci-auth-validators.ts | 5 +++-- docs/api-reference/overview/authentication.mdx | 8 ++++---- .../platform/identities/kubernetes-auth.mdx | 2 +- docs/documentation/platform/identities/oci-auth.mdx | 2 +- docs/documentation/platform/identities/token-auth.mdx | 2 +- .../platform/identities/universal-auth.mdx | 2 +- .../platform/secret-rotation/aws-iam-user-secret.mdx | 6 +++--- 8 files changed, 23 insertions(+), 14 deletions(-) diff --git a/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts b/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts index ad8aeb5cd..685ce6950 100644 --- a/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts +++ b/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts @@ -1,6 +1,7 @@ /* eslint-disable @typescript-eslint/no-unsafe-assignment */ import { ForbiddenError } from "@casl/ability"; import jwt from "jsonwebtoken"; +import RE2 from "re2"; import { IdentityAuthMethod } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; @@ -58,6 +59,13 @@ export const identityOciAuthServiceFactory = ({ await blockLocalAndPrivateIpAddresses(headers.host); + // Validate OCI host format + if (!headers.host || !new RE2("^identity\\.[a-zA-Z0-9-]+\\.oraclecloud\\.com$").test(headers.host)) { + throw new BadRequestError({ + message: "Invalid OCI host format. Expected format: identity..oraclecloud.com" + }); + } + const { data } = await request.get(`https://${headers.host}/20160918/users/${userOcid}`, { headers }); @@ -209,7 +217,7 @@ export const identityOciAuthServiceFactory = ({ if ( (accessTokenMaxTTL || identityOciAuth.accessTokenMaxTTL) > 0 && - (accessTokenTTL || identityOciAuth.accessTokenMaxTTL) > (accessTokenMaxTTL || identityOciAuth.accessTokenMaxTTL) + (accessTokenTTL || identityOciAuth.accessTokenTTL) > (accessTokenMaxTTL || identityOciAuth.accessTokenMaxTTL) ) { throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" }); } diff --git a/backend/src/services/identity-oci-auth/identity-oci-auth-validators.ts b/backend/src/services/identity-oci-auth/identity-oci-auth-validators.ts index 11c70f576..753bb5ea0 100644 --- a/backend/src/services/identity-oci-auth/identity-oci-auth-validators.ts +++ b/backend/src/services/identity-oci-auth/identity-oci-auth-validators.ts @@ -1,13 +1,14 @@ +import RE2 from "re2"; import { z } from "zod"; const usernameSchema = z .string() .min(1, "Username cannot be empty") - .regex(/^[a-zA-Z0-9._@-]+$/, "Invalid OCI username format"); - + .refine((val) => new RE2("^[a-zA-Z0-9._@-]+$").test(val), "Invalid OCI username format"); export const validateUsernames = z .string() .trim() + .max(500, "Input exceeds the maximum limit of 500 characters") .transform((val) => val .split(",") diff --git a/docs/api-reference/overview/authentication.mdx b/docs/api-reference/overview/authentication.mdx index bdd7df83b..4358e18d2 100644 --- a/docs/api-reference/overview/authentication.mdx +++ b/docs/api-reference/overview/authentication.mdx @@ -13,17 +13,17 @@ To interact with the Infisical API, you will need to obtain an access token. Fol There are a few reasons for why this might happen: - + - You have insufficient organization permissions to create, read, update, delete identities. - The identity you are trying to read, update, or delete is more privileged than yourself. - The role you are trying to create an identity for or update an identity to is more privileged than yours. There are a few reasons for why this might happen: - + - The client secret or access token has expired. - - The identity is insufficently permissioned to interact with the resources you wish to access. + - The identity is insufficiently permissioned to interact with the resources you wish to access. - You are attempting to access a `/raw` secrets endpoint that requires your project to disable E2EE. - The client secret/access token is being used from an untrusted IP. - \ No newline at end of file + diff --git a/docs/documentation/platform/identities/kubernetes-auth.mdx b/docs/documentation/platform/identities/kubernetes-auth.mdx index 8451c7607..9daff1e81 100644 --- a/docs/documentation/platform/identities/kubernetes-auth.mdx +++ b/docs/documentation/platform/identities/kubernetes-auth.mdx @@ -280,7 +280,7 @@ In the following steps, we explore how to create and use identities for your app There are a few reasons for why this might happen: - The access token has expired. -- The identity is insufficently permissioned to interact with the resources you wish to access. +- The identity is insufficiently permissioned to interact with the resources you wish to access. - The client access token is being used from an untrusted IP. diff --git a/docs/documentation/platform/identities/oci-auth.mdx b/docs/documentation/platform/identities/oci-auth.mdx index d8c276a7b..0a18e2e0e 100644 --- a/docs/documentation/platform/identities/oci-auth.mdx +++ b/docs/documentation/platform/identities/oci-auth.mdx @@ -143,7 +143,7 @@ const requestAsJson = { headers: Object.fromEntries(request.headers.entries()), }; -const res = await fetch("https://tunnel.util.lol/api/v1/auth/oci-auth/login", { +const res = await fetch("https://app.infisical.com/api/v1/auth/oci-auth/login", { method: "POST", headers: { "Content-Type": "application/json", diff --git a/docs/documentation/platform/identities/token-auth.mdx b/docs/documentation/platform/identities/token-auth.mdx index 9dea2ceae..f31e86517 100644 --- a/docs/documentation/platform/identities/token-auth.mdx +++ b/docs/documentation/platform/identities/token-auth.mdx @@ -123,7 +123,7 @@ using the Token Auth authentication method. There are a few reasons for why this might happen: - The access token has expired. If this is the case, you should obtain a new access token or consider extending the token's TTL. - - The identity is insufficently permissioned to interact with the resources you wish to access. + - The identity is insufficiently permissioned to interact with the resources you wish to access. - The access token is being used from an untrusted IP. diff --git a/docs/documentation/platform/identities/universal-auth.mdx b/docs/documentation/platform/identities/universal-auth.mdx index 585179ffe..44f468a17 100644 --- a/docs/documentation/platform/identities/universal-auth.mdx +++ b/docs/documentation/platform/identities/universal-auth.mdx @@ -161,7 +161,7 @@ using the Universal Auth authentication method. There are a few reasons for why this might happen: - The client secret or access token has expired. - - The identity is insufficently permissioned to interact with the resources you wish to access. + - The identity is insufficiently permissioned to interact with the resources you wish to access. - The client secret/access token is being used from an untrusted IP. diff --git a/docs/documentation/platform/secret-rotation/aws-iam-user-secret.mdx b/docs/documentation/platform/secret-rotation/aws-iam-user-secret.mdx index 1e8eb3950..c44d06d4a 100644 --- a/docs/documentation/platform/secret-rotation/aws-iam-user-secret.mdx +++ b/docs/documentation/platform/secret-rotation/aws-iam-user-secret.mdx @@ -182,10 +182,10 @@ In the following steps, we explore the end-to-end workflow for setting up this s - There are a few reasons for why this might happen: + There are a few reasons for why this might happen: - The strategy configuration is invalid (e.g. the managing IAM user's credentials are incorrect, the target AWS region is incorrect, etc.) - - The managing IAM user is insufficently permissioned to rotate the credentials of the target IAM user. For instance, you may have setup + - The managing IAM user is insufficiently permissioned to rotate the credentials of the target IAM user. For instance, you may have setup [paths](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/) for the managing IAM user and the policy does not have the necessary - permissions to rotate the credentials. + permissions to rotate the credentials.