From f0c2b53784f481b672fe90be66e2dd008349e9ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Anderson=20Val=C3=A9rio?= Date: Fri, 29 Nov 2024 15:15:55 -0300 Subject: [PATCH] reverting changes that only cause conflicts --- pkg/apis/options/load_test.go | 1 + pkg/apis/options/providers.go | 1 + pkg/cookies/cookies.go | 4 ++-- pkg/cookies/csrf_test.go | 2 +- pkg/encryption/utils.go | 3 ++- pkg/encryption/utils_test.go | 34 +++++++++++++++--------------- pkg/sessions/persistence/ticket.go | 1 - pkg/util/util.go | 1 + pkg/util/util_test.go | 1 + pkg/validation/options.go | 1 - pkg/validation/providers.go | 1 + providers/providers.go | 2 ++ providers/providers_test.go | 2 +- 13 files changed, 30 insertions(+), 24 deletions(-) diff --git a/pkg/apis/options/load_test.go b/pkg/apis/options/load_test.go index 53954d60..f82395cc 100644 --- a/pkg/apis/options/load_test.go +++ b/pkg/apis/options/load_test.go @@ -414,6 +414,7 @@ sub: } else { input = &TestOptions{} } + err := LoadYAML(configFileName, input) if in.expectedErr != nil { Expect(err).To(MatchError(in.expectedErr.Error())) diff --git a/pkg/apis/options/providers.go b/pkg/apis/options/providers.go index 8480dc35..a90b584c 100644 --- a/pkg/apis/options/providers.go +++ b/pkg/apis/options/providers.go @@ -85,6 +85,7 @@ type Provider struct { AllowedGroups []string `json:"allowedGroups,omitempty"` // The code challenge method CodeChallengeMethod string `json:"code_challenge_method,omitempty"` + // URL to call to perform backend logout, `{id_token}` would be replaced by the actual `id_token` if available in the session BackendLogoutURL string `json:"backendLogoutURL"` } diff --git a/pkg/cookies/cookies.go b/pkg/cookies/cookies.go index 858f444b..1e017366 100644 --- a/pkg/cookies/cookies.go +++ b/pkg/cookies/cookies.go @@ -35,12 +35,12 @@ func MakeCookieFromOptions(req *http.Request, name string, value string, opts *o SameSite: ParseSameSite(opts.SameSite), } - warnInvalidDomain(c, req) - if expiration != time.Duration(0) { c.Expires = now.Add(expiration) } + warnInvalidDomain(c, req) + return c } diff --git a/pkg/cookies/csrf_test.go b/pkg/cookies/csrf_test.go index cf60535c..97c1b496 100644 --- a/pkg/cookies/csrf_test.go +++ b/pkg/cookies/csrf_test.go @@ -28,10 +28,10 @@ var _ = Describe("CSRF Cookie Tests", func() { Domains: []string{cookieDomain}, Path: cookiePath, Expire: time.Hour, - CSRFExpire: time.Hour, Secure: true, HTTPOnly: true, CSRFPerRequest: false, + CSRFExpire: time.Hour, } var err error diff --git a/pkg/encryption/utils.go b/pkg/encryption/utils.go index fcc8f6fe..426a3131 100644 --- a/pkg/encryption/utils.go +++ b/pkg/encryption/utils.go @@ -58,7 +58,8 @@ func Validate(cookie *http.Cookie, seed string, expiration time.Duration) (value // creation timestamp stored in the cookie falls within the // window defined by (Now()-expiration, Now()]. t = time.Unix(int64(ts), 0) - if (expiration == time.Duration(0)) || t.After(time.Now().Add(expiration*-1)) && t.Before(time.Now().Add(time.Minute*5)) { // it's a valid cookie. now get the contents + if (expiration == time.Duration(0)) || (t.After(time.Now().Add(expiration*-1)) && t.Before(time.Now().Add(time.Minute*5))) { + // it's a valid cookie. now get the contents rawValue, err := base64.URLEncoding.DecodeString(parts[0]) if err == nil { value = rawValue diff --git a/pkg/encryption/utils_test.go b/pkg/encryption/utils_test.go index f13fbeab..9e69df84 100644 --- a/pkg/encryption/utils_test.go +++ b/pkg/encryption/utils_test.go @@ -106,23 +106,6 @@ func TestSignAndValidate(t *testing.T) { assert.False(t, checkSignature(sha1sig, seed, key, "tampered", epoch)) } -func TestGenerateRandomASCIIString(t *testing.T) { - randomString, err := GenerateRandomASCIIString(96) - assert.NoError(t, err) - - // Only 8-bit characters - assert.Equal(t, 96, len([]byte(randomString))) - - // All non-ascii characters removed should still be the original string - removedChars := strings.Map(func(r rune) rune { - if r > unicode.MaxASCII { - return -1 - } - return r - }, randomString) - assert.Equal(t, removedChars, randomString) -} - func TestValidate(t *testing.T) { seed := "0123456789abcdef" key := "cookie-name" @@ -146,3 +129,20 @@ func TestValidate(t *testing.T) { assert.NoError(t, err) assert.Equal(t, validValue, expectedValue) } + +func TestGenerateRandomASCIIString(t *testing.T) { + randomString, err := GenerateRandomASCIIString(96) + assert.NoError(t, err) + + // Only 8-bit characters + assert.Equal(t, 96, len([]byte(randomString))) + + // All non-ascii characters removed should still be the original string + removedChars := strings.Map(func(r rune) rune { + if r > unicode.MaxASCII { + return -1 + } + return r + }, randomString) + assert.Equal(t, removedChars, randomString) +} diff --git a/pkg/sessions/persistence/ticket.go b/pkg/sessions/persistence/ticket.go index b8f1559a..5020ada9 100644 --- a/pkg/sessions/persistence/ticket.go +++ b/pkg/sessions/persistence/ticket.go @@ -129,7 +129,6 @@ func decodeTicket(encTicket string, cookieOpts *options.Cookie) (*ticket, error) if errSecret != nil { return nil, fmt.Errorf("failed to decode ticket: %v", errSecret) } - return &ticket{ id: ticketID, secret: secret, diff --git a/pkg/util/util.go b/pkg/util/util.go index 6986121f..0f3d70ad 100644 --- a/pkg/util/util.go +++ b/pkg/util/util.go @@ -18,6 +18,7 @@ func GetCertPool(paths []string, useSystemPool bool) (*x509.CertPool, error) { if len(paths) == 0 { return nil, fmt.Errorf("invalid empty list of Root CAs file paths") } + var pool *x509.CertPool if useSystemPool { rootPool, err := getSystemCertPool() diff --git a/pkg/util/util_test.go b/pkg/util/util_test.go index 817d46f4..cdb40668 100644 --- a/pkg/util/util_test.go +++ b/pkg/util/util_test.go @@ -217,6 +217,7 @@ func TestGetCertPool(t *testing.T) { certFile1 := makeTestCertFile(t, root1Cert, tempDir) certFile2 := makeTestCertFile(t, root2Cert, tempDir) + for _, tc := range tests { // Append certs to "known" pool so we can compare them assert.True(t, tc.pool.AppendCertsFromPEM([]byte(root1Cert))) diff --git a/pkg/validation/options.go b/pkg/validation/options.go index 52737c32..8c804829 100644 --- a/pkg/validation/options.go +++ b/pkg/validation/options.go @@ -77,7 +77,6 @@ func Validate(o *options.Options) error { var redirectURL *url.URL redirectURL, msgs = parseURL(o.RawRedirectURL, "redirect", msgs) - o.SetRedirectURL(redirectURL) if o.RawRedirectURL == "" && !o.Cookie.Secure && !o.ReverseProxy { logger.Print("WARNING: no explicit redirect URL: redirects will default to insecure HTTP") diff --git a/pkg/validation/providers.go b/pkg/validation/providers.go index 44a2009f..ecc2d06d 100644 --- a/pkg/validation/providers.go +++ b/pkg/validation/providers.go @@ -75,6 +75,7 @@ func validateGoogleConfig(provider options.Provider) []string { if !hasGoogleGroups && !hasAdminEmail && !hasSAJSON && !useADC { return msgs } + if !hasGoogleGroups { msgs = append(msgs, "missing setting: google-group") } diff --git a/providers/providers.go b/providers/providers.go index ec7a0db9..ce5f93ef 100644 --- a/providers/providers.go +++ b/providers/providers.go @@ -160,7 +160,9 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData, } p.setAllowedGroups(providerConfig.AllowedGroups) + p.BackendLogoutURL = providerConfig.BackendLogoutURL + return p, nil } diff --git a/providers/providers_test.go b/providers/providers_test.go index 279f8a04..5c5df8a8 100644 --- a/providers/providers_test.go +++ b/providers/providers_test.go @@ -132,8 +132,8 @@ func TestScope(t *testing.T) { }{ { name: "oidc: with no scope provided", - configuredScope: "", configuredType: "oidc", + configuredScope: "", expectedScope: "openid email profile", }, {