mirror of
https://github.com/openfaas/faasd.git
synced 2025-06-10 08:56:47 +00:00
e33a60862d
This patch fixes a vulnerability in the secrets API, however it is important to stress that the user must be authenticated as the admin user on the REST API before they can attempt this. Reported by Appsecco via email. @lucasroesler, Appsecco and myself believe this to be of low severity. The fix prevents directory traversal characters from being used in secret names. If a secret name such as: ../../root/.ssh/authorized_keys were to be used, an attacker could remove the value and write their own. Tested with unit tests and tests are now made to run via the CI and a new Makefile target. Signed-off-by: Alex Ellis (OpenFaaS Ltd) <alexellis2@gmail.com>
64 lines
1.4 KiB
Go
64 lines
1.4 KiB
Go
package handlers
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/openfaas/faas-provider/types"
|
|
)
|
|
|
|
func Test_parseSecretValidName(t *testing.T) {
|
|
|
|
s := types.Secret{Name: "authorized_keys"}
|
|
body, _ := json.Marshal(s)
|
|
reader := bytes.NewReader(body)
|
|
r := httptest.NewRequest(http.MethodPost, "/", reader)
|
|
_, err := parseSecret(r)
|
|
|
|
if err != nil {
|
|
t.Fatalf("secret name is valid with no traversal characters")
|
|
}
|
|
}
|
|
|
|
func Test_parseSecretValidNameWithDot(t *testing.T) {
|
|
|
|
s := types.Secret{Name: "authorized.keys"}
|
|
body, _ := json.Marshal(s)
|
|
reader := bytes.NewReader(body)
|
|
r := httptest.NewRequest(http.MethodPost, "/", reader)
|
|
_, err := parseSecret(r)
|
|
|
|
if err != nil {
|
|
t.Fatalf("secret name is valid with no traversal characters")
|
|
}
|
|
}
|
|
|
|
func Test_parseSecretWithTraversalWithSlash(t *testing.T) {
|
|
|
|
s := types.Secret{Name: "/root/.ssh/authorized_keys"}
|
|
body, _ := json.Marshal(s)
|
|
reader := bytes.NewReader(body)
|
|
r := httptest.NewRequest(http.MethodPost, "/", reader)
|
|
_, err := parseSecret(r)
|
|
|
|
if err == nil {
|
|
t.Fatalf("secret name should fail due to path traversal")
|
|
}
|
|
}
|
|
|
|
func Test_parseSecretWithTraversalWithDoubleDot(t *testing.T) {
|
|
|
|
s := types.Secret{Name: ".."}
|
|
body, _ := json.Marshal(s)
|
|
reader := bytes.NewReader(body)
|
|
r := httptest.NewRequest(http.MethodPost, "/", reader)
|
|
_, err := parseSecret(r)
|
|
|
|
if err == nil {
|
|
t.Fatalf("secret name should fail due to path traversal")
|
|
}
|
|
}
|