awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: Security vulnurbility making it possible to spoof env & secret path requested.

Browse Source
This commit is contained in:
Daniel Hougaard
2024-04-04 01:00:14 -07:00
parent 4cb51805f0
commit f1428d72c2
1 changed files with 1 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
backend/src/ee/routes/v1/access-approval-request-router.ts
View File

@@ -16,9 +16,7 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
temporaryRange: z.string().optional() temporaryRange: z.string().optional()
}), }),
querystring: z.object({ querystring: z.object({
projectSlug: z.string().trim(), projectSlug: z.string().trim()
secretPath: z.string().trim(),
envSlug: z.string().trim()
}), }),
response: { response: {
200: z.object({ 200: z.object({
@@ -33,9 +31,7 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
actorId: req.permission.id, actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod, actorAuthMethod: req.permission.authMethod,
permissions: req.body.permissions, permissions: req.body.permissions,
envSlug: req.query.envSlug,
actorOrgId: req.permission.orgId, actorOrgId: req.permission.orgId,
secretPath: req.query.secretPath,
projectSlug: req.query.projectSlug, projectSlug: req.query.projectSlug,
temporaryRange: req.body.temporaryRange, temporaryRange: req.body.temporaryRange,
isTemporary: req.body.isTemporary isTemporary: req.body.isTemporary