awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: Security vulnurbility making it possible to spoof env & secret path requested.

Browse Source
This commit is contained in:
Daniel Hougaard
2024-04-04 01:00:14 -07:00
parent 5117f5d3c1
commit 7d1dff9e5a
1 changed files with 1 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
backend/src/ee/routes/v1/access-approval-request-router.ts
View File

@@ -16,9 +16,7 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
temporaryRange: z.string().optional()
}),
querystring: z.object({
projectSlug: z.string().trim(),
secretPath: z.string().trim(),
envSlug: z.string().trim()
projectSlug: z.string().trim()
}),
response: {
200: z.object({
@@ -33,9 +31,7 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
permissions: req.body.permissions,
envSlug: req.query.envSlug,
actorOrgId: req.permission.orgId,
secretPath: req.query.secretPath,
projectSlug: req.query.projectSlug,
temporaryRange: req.body.temporaryRange,
isTemporary: req.body.isTemporary