awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve requested user/host validation for ssh certificate template

Browse Source
This commit is contained in:
Tuan Dang
2024-12-03 23:22:04 -08:00
parent 00ce755996
commit 8edfa9ad0b
2 changed files with 54 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
backend/src/ee/services/ssh-certificate-template/ssh-certificate-template-service.ts
View File

@@ -130,7 +130,7 @@ export const sshCertificateTemplateServiceFactory = ({
if (name) {
const existingTemplate = await sshCertificateTemplateDAL.getByName(name, actorOrgId);
if (existingTemplate) {
if (existingTemplate && existingTemplate.id !== id) {
throw new BadRequestError({
message: `SSH certificate template with name ${name} already exists`
});

70
backend/src/ee/services/ssh/ssh-certificate-authority-fns.ts
View File

@@ -122,34 +122,70 @@ export const validateSshCertificatePrincipals = (
) => {
switch (certType) {
case SshCertType.USER: {
const allowsAllUsers = template.allowedUsers?.includes("*") ?? false;
return principals.every((principal) => {
if (principal === "*") return false;
if (allowsAllUsers) return isValidUserPattern(principal);
return template.allowedUsers?.includes(principal);
if (template.allowedUsers.length === 0) {
throw new BadRequestError({
message: "No allowed users are configured in the SSH certificate template."
});
}
const allowsAllUsers = template.allowedUsers.includes("*") ?? false;
principals.forEach((principal) => {
if (principal === "*") {
throw new BadRequestError({
message: `Principal '*' is not allowed for user certificates.`
});
}
if (allowsAllUsers && !isValidUserPattern(principal)) {
throw new BadRequestError({
message: `Principal '${principal}' does not match a valid user pattern.`
});
}
if (!allowsAllUsers && !template.allowedUsers.includes(principal)) {
throw new BadRequestError({
message: `Principal '${principal}' is not in the list of allowed users.`
});
}
});
break;
}
case SshCertType.HOST: {
const allowsAllHosts = template.allowedHosts?.includes("*") ?? false;
return principals.every((principal) => {
if (principal.includes("*")) return false;
if (allowsAllHosts) return isValidHostPattern(principal);
if (template.allowedHosts.length === 0) {
throw new BadRequestError({
message: "No allowed hosts are configured in the SSH certificate template."
});
}
// Validate against allowed domains
return (
isValidHostPattern(principal) &&
template.allowedHosts?.some((allowedHost) => {
const allowsAllHosts = template.allowedHosts.includes("*") ?? false;
principals.forEach((principal) => {
if (principal.includes("*")) {
throw new BadRequestError({
message: `Principal '${principal}' with wildcards is not allowed for host certificates.`
});
}
if (allowsAllHosts && !isValidHostPattern(principal)) {
throw new BadRequestError({
message: `Principal '${principal}' does not match a valid host pattern.`
});
}
if (
!allowsAllHosts &&
!template.allowedHosts.some((allowedHost) => {
if (allowedHost.startsWith("*.")) {
// Match subdomains of a wildcard domain
const baseDomain = allowedHost.slice(2); // Remove the leading "*."
return principal.endsWith(`.${baseDomain}`);
}
// Exact match for non-wildcard domains
return principal === allowedHost;
})
);
) {
throw new BadRequestError({
message: `Principal '${principal}' is not in the list of allowed hosts or domains.`
});
}
});
break;
}
default:
throw new BadRequestError({