awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-16 19:28:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix review feedbacks

Browse Source
This commit is contained in:
Fang-Pen Lin
2025-11-07 09:21:15 -08:00
parent eebf62f30c
commit d4c9c4464b
5 changed files with 30 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts
+5
View File
@@ -1,5 +1,6 @@
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { isPrivateIp } from "@app/lib/ip/ipRange";
import { logger } from "@app/lib/logger";
import { TPkiAcmeChallengeDALFactory } from "./pki-acme-challenge-dal";
import {
@@ -53,6 +54,10 @@ export const pkiAcmeChallengeServiceFactory = ({
throw new BadRequestError({ message: "Only HTTP-01 challenges are supported for now" });
}
let host = challenge.auth.identifierValue;
// check if host is a private ip address
if (isPrivateIp(host)) {
throw new BadRequestError({ message: "Private IP addresses are not allowed" });
}
if (appCfg.isAcmeDevelopmentMode && appCfg.ACME_DEVELOPMENT_HTTP01_CHALLENGE_HOST_OVERRIDES[host]) {
host = appCfg.ACME_DEVELOPMENT_HTTP01_CHALLENGE_HOST_OVERRIDES[host];
logger.warn(
backend/src/ee/services/pki-acme/pki-acme-service.ts
+4 -3
View File
@@ -7,6 +7,7 @@ import { TCertificateProfileDALFactory } from "@app/services/certificate-profile
import * as x509 from "@peculiar/x509";
import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
import { isPrivateIp } from "@app/lib/ip/ipRange";
import { ActorType } from "@app/services/auth/auth-type";
import {
EnrollmentType,
@@ -497,7 +498,9 @@ export const pkiAcmeServiceFactory = ({
if (identifier.type !== AcmeIdentifierType.DNS) {
throw new AcmeUnsupportedIdentifierError({ detail: "Only DNS identifiers are supported" });
}
// TODO: reuse existing authorizations for this identifier if they exist
if (isPrivateIp(identifier.value)) {
throw new AcmeUnsupportedIdentifierError({ detail: "Private IP addresses are not allowed" });
}
const auth = await acmeAuthDAL.create(
{
accountId: account.id,
@@ -600,8 +603,6 @@ export const pkiAcmeServiceFactory = ({
throw new AcmeOrderNotReadyError({ message: "ACME order has expired" });
}
const { csr } = payload;
// TODO: validate the CSR and return badCSR error if it's invalid
// TODO: this should be the same transaction?
let errorToReturn: Error | undefined;
try {
const { certificateId } = await certificateV3Service.signCertificateFromProfile({