awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: added validation against confused deputy

Browse Source
This commit is contained in:
Sheen Capadngan
2025-01-27 17:30:26 +08:00
parent d0d5556bd0
commit f9ac7442df
3 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
backend/src/services/app-connection/gcp/gcp-connection-fns.ts
View File

@@ -146,6 +146,18 @@ export const getGcpSecretManagerProjects = async (appConnection: TGcpConnection)
};
export const validateGcpConnectionCredentials = async (appConnection: TGcpConnectionConfig) => {
// Check if provided service account email prefix matches organization ID.
// We do this to mitigate confused deputy attacks in multi-tenant instances
const expectedEmailPrefix = appConnection.orgId.split("-").slice(0, 2).join("-");
if (
appConnection.credentials.serviceAccountEmail &&
!appConnection.credentials.serviceAccountEmail.startsWith(expectedEmailPrefix)
) {
throw new BadRequestError({
message: `GCP service account email must have a prefix of "${expectedEmailPrefix}"`
});
}
await getAuthToken(appConnection);
return appConnection.credentials;

2
backend/src/services/app-connection/gcp/gcp-connection-schemas.ts
View File

@@ -11,7 +11,7 @@ import {
import { GcpConnectionMethod } from "./gcp-connection-enums";
export const GcpConnectionServiceAccountImpersonationCredentialsSchema = z.object({
serviceAccountEmail: z.string().trim().min(1, "Service account email required")
serviceAccountEmail: z.string().email().trim().min(1, "Service account email required")
});
const BaseGcpConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.GCP) });