Preston_PLB
/
oauth2
forked from Mirrors/oauth2
1
0
Fork 0
Code Pull Requests Activity

filter URL to exclude path, update regex accordingly

This commit is contained in:
Patrick Jones 2021-08-11 14:41:07 -07:00
parent 844e38f109
commit 280ee39d14
2 changed files with 23 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
google/internal/externalaccount/basecredentials.go
View File

@ -8,6 +8,7 @@ import (
"context"
"fmt"
"net/http"
"net/url"
"regexp"
"strconv"
"time"
@ -60,22 +61,29 @@ var (
validTokenURLPatterns = []*regexp.Regexp{
// The complicated part in the middle matches any number of characters that
// aren't period, spaces, or slashes.
regexp.MustCompile("^https://[^\\.\\s\\/\\\\]+\\.sts\\.googleapis\\.com"),
regexp.MustCompile("^https://sts\\.googleapis\\.com"),
regexp.MustCompile("^https://sts\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com"),
regexp.MustCompile("^https://[^\\.\\s\\/\\\\]+-sts\\.googleapis\\.com"),
regexp.MustCompile("^https://[^\\.\\s\\/\\\\]+\\.sts\\.googleapis\\.com$"),
regexp.MustCompile("^https://sts\\.googleapis\\.com$"),
regexp.MustCompile("^https://sts\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$"),
regexp.MustCompile("^https://[^\\.\\s\\/\\\\]+-sts\\.googleapis\\.com$"),
}
validImpersonateURLPatterns = []*regexp.Regexp{
regexp.MustCompile("^https://[^\\.\\s\\/\\\\]+\\.iamcredentials\\.googleapis\\.com"),
regexp.MustCompile("^https://iamcredentials\\.googleapis\\.com"),
regexp.MustCompile("^https://iamcredentials\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com"),
regexp.MustCompile("^https://[^\\.\\s\\/\\\\]+-iamcredentials\\.googleapis\\.com"),
regexp.MustCompile("^https://[^\\.\\s\\/\\\\]+\\.iamcredentials\\.googleapis\\.com$"),
regexp.MustCompile("^https://iamcredentials\\.googleapis\\.com$"),
regexp.MustCompile("^https://iamcredentials\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$"),
regexp.MustCompile("^https://[^\\.\\s\\/\\\\]+-iamcredentials\\.googleapis\\.com$"),
}
)
func validateURL(input string, patterns []*regexp.Regexp) bool {
parsed, err := url.Parse(input)
if err != nil {
return false
}
path := parsed.Path
toTest := input[0 : len(input)-len(path)]
for _, pattern := range patterns {
valid := pattern.MatchString(input)
valid := pattern.MatchString(toTest)
if valid {
return true
}

8
google/internal/externalaccount/basecredentials_test.go
View File

@ -107,12 +107,14 @@ func TestValidateURLTokenURL(t *testing.T) {
{"https://sts.googleapis.com", validTokenURLPatterns, true},
{"https://sts.asfeasfesef.googleapis.com", validTokenURLPatterns, true},
{"https://us-east-1-sts.googleapis.com", validTokenURLPatterns, true},
{"https://.sts.google.com", validTokenURLPatterns, false},
{"https://sts.googleapis.com/your/path/here", validTokenURLPatterns, true},
{"https://.sts.googleapis.com", validTokenURLPatterns, false},
{"https://badsts.googleapis.com", validTokenURLPatterns, false},
{"https://sts.asfe.asfesef.googleapis.com", validTokenURLPatterns, false},
{"https://sts..googleapis.com", validTokenURLPatterns, false},
{"https://-sts.googleapis.com", validTokenURLPatterns, false},
{"https://us-ea.st-1-sts.googleapis.com", validTokenURLPatterns, false},
{"https://sts.googleapis.com.evil.com/whatever/path", validTokenURLPatterns, false},
}
for _, tt := range urlValidityTests {
t.Run(" "+tt.input, func(t *testing.T) { // We prepend a space ahead of the test input when outputting for sake of readability.
@ -124,7 +126,7 @@ func TestValidateURLTokenURL(t *testing.T) {
}
}
func TestValidateURLImpersonateURL (t *testing.T) {
func TestValidateURLImpersonateURL(t *testing.T) {
var urlValidityTests = []struct {
input string
pattern []*regexp.Regexp
@ -134,12 +136,14 @@ func TestValidateURLImpersonateURL (t *testing.T) {
{"https://iamcredentials.googleapis.com", validImpersonateURLPatterns, true},
{"https://iamcredentials.asfeasfesef.googleapis.com", validImpersonateURLPatterns, true},
{"https://us-east-1-iamcredentials.googleapis.com", validImpersonateURLPatterns, true},
{"https://iamcredentials.googleapis.com/your/path/here", validImpersonateURLPatterns, true},
{"https://.iamcredentials.googleapis.com", validImpersonateURLPatterns, false},
{"https://badiamcredentials.googleapis.com", validImpersonateURLPatterns, false},
{"https://iamcredentials.asfe.asfesef.googleapis.com", validImpersonateURLPatterns, false},
{"https://iamcredentials..googleapis.com", validImpersonateURLPatterns, false},
{"https://-iamcredentials.googleapis.com", validImpersonateURLPatterns, false},
{"https://us-ea.st-1-iamcredentials.googleapis.com", validImpersonateURLPatterns, false},
{"https://iamcredentials.googleapis.com.evil.com/whatever/path", validImpersonateURLPatterns, false},
}
for _, tt := range urlValidityTests {
t.Run(" "+tt.input, func(t *testing.T) { // We prepend a space ahead of the test input when outputting for sake of readability.