awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactor ldap filter validation

Browse Source
This commit is contained in:
Tuan Dang
2024-04-24 21:19:07 -07:00
parent 1ac18fcf0c
commit b01d381993
2 changed files with 13 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
backend/src/ee/routes/v1/ldap-router.ts
View File

@@ -54,13 +54,18 @@ export const registerLdapRouter = async (server: FastifyZodProvider) => {
try {
const ldapConfig = (req as unknown as FastifyRequest).ldapConfig as TLDAPConfig;
const groupFilter = "(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))";
const groupSearchFilter = (ldapConfig.groupSearchFilter || groupFilter)
.replace(/{{\.Username}}/g, user.uid)
.replace(/{{\.UserDN}}/g, user.dn);
let groups: { dn: string; cn: string }[] | undefined;
if (ldapConfig.groupSearchBase) {
const groupFilter = "(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))";
const groupSearchFilter = (ldapConfig.groupSearchFilter || groupFilter)
.replace(/{{\.Username}}/g, user.uid)
.replace(/{{\.UserDN}}/g, user.dn);
if (!isValidLdapFilter(groupSearchFilter)) {
throw new Error("Generated LDAP search filter is invalid.");
if (!isValidLdapFilter(groupSearchFilter)) {
throw new Error("Generated LDAP search filter is invalid.");
}
groups = await searchGroups(ldapConfig, groupSearchFilter, ldapConfig.groupSearchBase);
}
const { isUserCompleted, providerAuthToken } = await server.services.ldap.ldapLogin({
@@ -70,9 +75,7 @@ export const registerLdapRouter = async (server: FastifyZodProvider) => {
firstName: user.givenName ?? user.cn ?? "",
lastName: user.sn ?? "",
emails: user.mail ? [user.mail] : [],
groups: ldapConfig.groupSearchBase
? await searchGroups(ldapConfig, groupSearchFilter, ldapConfig.groupSearchBase)
: undefined,
groups,
relayState: ((req as unknown as FastifyRequest).body as { RelayState?: string }).RelayState,
orgId: (req as unknown as FastifyRequest).ldapConfig.organization
});

30
backend/src/ee/services/ldap-config/ldap-config-service.ts
View File

@@ -40,7 +40,7 @@ import {
TTestLdapConnectionDTO,
TUpdateLdapCfgDTO
} from "./ldap-config-types";
import { isValidLdapFilter, testLDAPConfig } from "./ldap-fns";
import { testLDAPConfig } from "./ldap-fns";
import { TLdapGroupMapDALFactory } from "./ldap-group-map-dal";
type TLdapConfigServiceFactoryDep = {
@@ -113,18 +113,6 @@ export const ldapConfigServiceFactory = ({
"Failed to create LDAP configuration due to plan restriction. Upgrade plan to create LDAP configuration."
});
const isSearchFilterValid = isValidLdapFilter(searchFilter);
if (!isSearchFilterValid)
throw new BadRequestError({
message: "Failed to create LDAP configuration due to invalid search filter."
});
const isGroupSearchFilterValid = isValidLdapFilter(groupSearchFilter);
if (!isGroupSearchFilterValid)
throw new BadRequestError({
message: "Failed to create LDAP configuration due to invalid group search filter."
});
const orgBot = await orgBotDAL.transaction(async (tx) => {
const doc = await orgBotDAL.findOne({ orgId }, tx);
if (doc) return doc;
@@ -225,22 +213,6 @@ export const ldapConfigServiceFactory = ({
"Failed to update LDAP configuration due to plan restriction. Upgrade plan to update LDAP configuration."
});
if (searchFilter) {
const isSearchFilterValid = isValidLdapFilter(searchFilter);
if (!isSearchFilterValid)
throw new BadRequestError({
message: "Failed to update LDAP configuration due to invalid search filter."
});
}
if (groupSearchFilter) {
const isGroupSearchFilterValid = isValidLdapFilter(groupSearchFilter);
if (!isGroupSearchFilterValid)
throw new BadRequestError({
message: "Failed to update LDAP configuration due to invalid group search filter."
});
}
const updateQuery: TLdapConfigsUpdate = {
isActive,
url,