Sirius/tinyauth
1
0
Fork 0
mirror of https://github.com/tinyauthapp/tinyauth.git synced 2026-08-11 19:43:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(acls): auth bypass via forward auth

Browse Source
This commit is contained in:
Scott McKendry
2026-07-27 19:43:47 +12:00
parent c7077a7c84
commit 3d5ab54ab8
5 changed files with 114 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controller/proxy_controller.go
+7 -1
View File
@@ -390,6 +390,12 @@ func (controller *ProxyController) getForwardAuthContext(c *gin.Context) (ProxyC
return ProxyContext{}, errors.New("x-forwarded-uri not found")
}
parsedURI, err := url.ParseRequestURI(uri)
if err != nil {
return ProxyContext{}, fmt.Errorf("invalid x-forwarded-uri: %w", err)
}
proto, ok := controller.getHeader(c, "x-forwarded-proto")
if !ok {
@@ -403,7 +409,7 @@ func (controller *ProxyController) getForwardAuthContext(c *gin.Context) (ProxyC
return ProxyContext{
Host: host,
Proto: proto,
Path: uri,
Path: parsedURI.Path,
Method: method,
Type: ForwardAuth,
}, nil
internal/controller/proxy_controller_test.go
+60
View File
@@ -287,6 +287,66 @@ func TestProxyController(t *testing.T) {
assert.Equal(t, http.StatusOK, recorder.Code)
},
},
{
description: "Ensure path allow ACL does not match forwarded URI query string",
middlewares: []gin.HandlerFunc{},
run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
req.Header.Set("x-forwarded-host", "path-allow.example.com")
req.Header.Set("x-forwarded-proto", "https")
req.Header.Set("x-forwarded-uri", "/admin?path=/allowed")
router.ServeHTTP(recorder, req)
assert.Equal(t, http.StatusUnauthorized, recorder.Code)
},
},
{
description: "Ensure path allow ACL does not match path substrings",
middlewares: []gin.HandlerFunc{},
run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
req.Header.Set("x-forwarded-host", "path-allow.example.com")
req.Header.Set("x-forwarded-proto", "https")
req.Header.Set("x-forwarded-uri", "/admin/allowed")
router.ServeHTTP(recorder, req)
assert.Equal(t, http.StatusUnauthorized, recorder.Code)
},
},
{
description: "Ensure path block ACL works on forward auth",
middlewares: []gin.HandlerFunc{},
run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
req.Header.Set("x-forwarded-host", "path-block.example.com")
req.Header.Set("x-forwarded-proto", "https")
req.Header.Set("x-forwarded-uri", "/blocked")
router.ServeHTTP(recorder, req)
assert.Equal(t, http.StatusUnauthorized, recorder.Code)
},
},
{
description: "Ensure path block ACL does not match forwarded URI query string",
middlewares: []gin.HandlerFunc{},
run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
req.Header.Set("x-forwarded-host", "path-block.example.com")
req.Header.Set("x-forwarded-proto", "https")
req.Header.Set("x-forwarded-uri", "/admin?path=/blocked")
router.ServeHTTP(recorder, req)
assert.Equal(t, http.StatusOK, recorder.Code)
},
},
{
description: "Ensure path block ACL does not match path substrings",
middlewares: []gin.HandlerFunc{},
run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
req.Header.Set("x-forwarded-host", "path-block.example.com")
req.Header.Set("x-forwarded-proto", "https")
req.Header.Set("x-forwarded-uri", "/admin/blocked")
router.ServeHTTP(recorder, req)
assert.Equal(t, http.StatusOK, recorder.Code)
},
},
{
description: "Ensure path allow ACL works on nginx auth request",
middlewares: []gin.HandlerFunc{},
internal/service/access_controls_rules.go
+26 -15
View File
@@ -2,7 +2,6 @@ package service
import (
"errors"
"regexp"
"strings"
"github.com/tinyauthapp/tinyauth/internal/model"
@@ -180,33 +179,45 @@ type AuthEnabledRule struct {
Log *logger.Logger
}
func matchPathRule(paths, path string) bool {
for _, configuredPath := range strings.Split(paths, ",") {
configuredPath = strings.TrimSpace(configuredPath)
if configuredPath == "/" {
return true
}
configuredPath = strings.TrimRight(configuredPath, "/")
if configuredPath == "" {
continue
}
if path == configuredPath || strings.HasPrefix(path, configuredPath+"/") {
return true
}
}
return false
}
func (rule *AuthEnabledRule) Evaluate(ctx *ACLContext) Effect {
if ctx.ACLs == nil {
return EffectDeny
}
if ctx.ACLs.Path.Block != "" {
regex, err := regexp.Compile(ctx.ACLs.Path.Block)
match := matchPathRule(ctx.ACLs.Path.Block, ctx.Path)
if err != nil {
rule.Log.App.Error().Err(err).Msg("Failed to compile block regex")
return EffectDeny
}
if !regex.MatchString(ctx.Path) {
if !match {
return EffectAllow
}
}
if ctx.ACLs.Path.Allow != "" {
regex, err := regexp.Compile(ctx.ACLs.Path.Allow)
match := matchPathRule(ctx.ACLs.Path.Allow, ctx.Path)
if err != nil {
rule.Log.App.Error().Err(err).Msg("Failed to compile allow regex")
return EffectDeny
}
if regex.MatchString(ctx.Path) {
if match {
return EffectAllow
}
}
internal/service/access_controls_rules_test.go
+13 -23
View File
@@ -527,52 +527,52 @@ func TestAuthEnabledRule(t *testing.T) {
expected: EffectDeny,
},
{
name: "allows when path does not match block regex",
name: "allows when path does not match block path",
ctx: &ACLContext{
ACLs: &model.App{
Path: model.AppPath{Block: "^/admin"},
Path: model.AppPath{Block: "/admin"},
},
Path: "/public",
},
expected: EffectAllow,
},
{
name: "denies when path matches block regex and no allow regex",
name: "denies when path matches block path",
ctx: &ACLContext{
ACLs: &model.App{
Path: model.AppPath{Block: "^/admin"},
Path: model.AppPath{Block: "/admin"},
},
Path: "/admin/users",
},
expected: EffectDeny,
},
{
name: "allows when path matches allow regex",
name: "allows when path matches allow path",
ctx: &ACLContext{
ACLs: &model.App{
Path: model.AppPath{Allow: "^/public"},
Path: model.AppPath{Allow: "/public"},
},
Path: "/public/index",
},
expected: EffectAllow,
},
{
name: "denies when path does not match allow regex",
name: "denies when path does not match allow path",
ctx: &ACLContext{
ACLs: &model.App{
Path: model.AppPath{Allow: "^/public"},
Path: model.AppPath{Allow: "/public"},
},
Path: "/private",
},
expected: EffectDeny,
},
{
name: "allows when blocked path is also explicitly allowed",
name: "allows when blocked path is explicitly allowed",
ctx: &ACLContext{
ACLs: &model.App{
Path: model.AppPath{
Block: "^/admin",
Allow: "^/admin/public",
Block: "/admin",
Allow: "/admin/public",
},
},
Path: "/admin/public/page",
@@ -580,20 +580,10 @@ func TestAuthEnabledRule(t *testing.T) {
expected: EffectAllow,
},
{
name: "denies when block regex fails to compile",
name: "denies when root is blocked",
ctx: &ACLContext{
ACLs: &model.App{
Path: model.AppPath{Block: "[invalid"},
},
Path: "/anything",
},
expected: EffectDeny,
},
{
name: "denies when allow regex fails to compile",
ctx: &ACLContext{
ACLs: &model.App{
Path: model.AppPath{Allow: "[invalid"},
Path: model.AppPath{Block: "/"},
},
Path: "/anything",
},
internal/test/test.go
+8
View File
@@ -61,6 +61,14 @@ func CreateTestConfigs(t *testing.T) (model.Config, model.RuntimeConfig) {
Allow: "/allowed",
},
},
"app_path_block": {
Config: model.AppConfig{
Domain: "path-block.example.com",
},
Path: model.AppPath{
Block: "/blocked",
},
},
"app_user_allow": {
Config: model.AppConfig{
Domain: "user-allow.example.com",