241015 main from release ( v3.2.1 ) #545
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tks 요청이 정책에 차단되지 않도록 템플릿 생성 시 가드 추가
feature. add api to audit
[RE] bugfix. fix permission ordering error
feature. change audit scheme and remove database constraint
trivial. fix typo
trivial. add organization name to audits
trivial. add favorite field to stack response
trivial. add appserveapps count to stack response
20240425 change projects function
feature. personalization systemNotifications
파라미터 추출 개선, 글로벌 변수 할당 처리
feature. change email html
including deprecation of legacy one
trivial. update html temporary_password
trivial. minor fixes
trivial. fix parameters for creating lma
trivial. fix minor bug
feature. add import api to stacks resource
feature. add import api to stacks resource
trivial. change type to string from []byte for kubeconfig
trivial. change type to string from []byte for kubeconfig
feature. add GetCloudServices to stack-template API
feature. add pprof for profiling
trivial. remove omitempty for getStack response
trivial. change deliminator for domains
trivial. change deliminator for domains
trivial. fix lint error
20241002 release from develop
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -37,3 +38,18 @@ | |||
| } | |||
| return token, err | |||
| } | |||
|
|
|||
| func StringToTokenWithoutVerification(tokenString string) (*jwt.Token, error) { | |||
| token, _, err := new(jwt.Parser).ParseUnverified(tokenString, jwt.MapClaims{}) | |||
Check failure
Code scanning / CodeQL
Missing JWT signature check High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the problem, we need to ensure that the JWT is always parsed with signature verification. This involves replacing the StringToTokenWithoutVerification function with a function that verifies the token's signature using a predefined signing key. We will use the jwt.Parse method with a key function to achieve this.
- Replace the
StringToTokenWithoutVerificationfunction ininternal/helper/jwt.gowith a new function that verifies the token's signature. - Update the
AuthenticateTokenmethod ininternal/middleware/auth/authenticator/keycloak/keycloak.goto use the new function.
Suggested changeset
2
internal/helper/jwt.go
| @@ -41,6 +41,9 @@ | ||
|
|
||
| func StringToTokenWithoutVerification(tokenString string) (*jwt.Token, error) { | ||
| token, _, err := new(jwt.Parser).ParseUnverified(tokenString, jwt.MapClaims{}) | ||
| func VerifyTokenWithClaims(tokenString string) (*jwt.Token, error) { | ||
| signingKey := []byte(viper.GetString("jwt-secret")) | ||
| token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) { | ||
| return signingKey, nil | ||
| }) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("invalid token") | ||
| return nil, fmt.Errorf("invalid token: %v", err) | ||
| } |
internal/middleware/auth/authenticator/keycloak/keycloak.go
Outside changed files
| @@ -51,3 +51,3 @@ | ||
| func (a *keycloakAuthenticator) AuthenticateToken(r *http.Request, token string) (*authenticator.Response, bool, error) { | ||
| parsedToken, err := helper.StringToTokenWithoutVerification(token) | ||
| parsedToken, err := helper.VerifyTokenWithClaims(token) | ||
| if err != nil { |
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
241015 main from release ( v3.2.1 )