awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-02 23:25:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: Security vulnurbility making it possible to spoof env & secret path requested.

Browse Source
This commit is contained in:
Daniel Hougaard
2024-05-07 17:30:36 +02:00
parent 5117f5d3c1
commit 7d1dff9e5a
1 changed files with 1 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/routes/v1/access-approval-request-router.ts
+1 -5
View File
@@ -16,9 +16,7 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
temporaryRange: z.string().optional() temporaryRange: z.string().optional()
}), }),
querystring: z.object({ querystring: z.object({
projectSlug: z.string().trim(), projectSlug: z.string().trim()
secretPath: z.string().trim(),
envSlug: z.string().trim()
}), }),
response: { response: {
200: z.object({ 200: z.object({
@@ -33,9 +31,7 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
actorId: req.permission.id, actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod, actorAuthMethod: req.permission.authMethod,
permissions: req.body.permissions, permissions: req.body.permissions,
envSlug: req.query.envSlug,
actorOrgId: req.permission.orgId, actorOrgId: req.permission.orgId,
secretPath: req.query.secretPath,
projectSlug: req.query.projectSlug, projectSlug: req.query.projectSlug,
temporaryRange: req.body.temporaryRange, temporaryRange: req.body.temporaryRange,
isTemporary: req.body.isTemporary isTemporary: req.body.isTemporary