yuuza/outline
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: consistently check allowed domains (#2985)

Browse Source 
* fix: ensure consistency of checking allowed domain

* chore: update comment to match the logic
This commit is contained in:
Eugene Sokolov
2022-01-24 01:40:18 +00:00
committed by GitHub
parent 390a1343b7
commit b52b1b02fe
4 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
server/commands/teamCreator.ts
View File

@@ -1,7 +1,7 @@
import invariant from "invariant"; import invariant from "invariant";
import Logger from "@server/logging/logger"; import Logger from "@server/logging/logger";
import { Team, AuthenticationProvider } from "@server/models"; import { Team, AuthenticationProvider } from "@server/models";
import { getAllowedDomains } from "@server/utils/authentication"; import { isDomainAllowed } from "@server/utils/authentication";
import { generateAvatarUrl } from "@server/utils/avatars"; import { generateAvatarUrl } from "@server/utils/avatars";
import { MaximumTeamsError } from "../errors"; import { MaximumTeamsError } from "../errors";
@@ -57,9 +57,9 @@ export default async function teamCreator({
const teamCount = await Team.count(); const teamCount = await Team.count();
// If the self-hosted installation has a single team and the domain for the // If the self-hosted installation has a single team and the domain for the
// new team matches one in the allowed domains env variable then assign the // new team is allowed then assign the authentication provider to the
// authentication provider to the existing team // existing team
if (teamCount === 1 && domain && getAllowedDomains().includes(domain)) { if (teamCount === 1 && domain && isDomainAllowed(domain)) {
const team = await Team.findOne(); const team = await Team.findOne();
invariant(team, "Team should exist"); invariant(team, "Team should exist");

5
server/routes/auth/providers/google.ts
View File

@@ -10,14 +10,13 @@ import {
GoogleWorkspaceInvalidError, GoogleWorkspaceInvalidError,
} from "@server/errors"; } from "@server/errors";
import passportMiddleware from "@server/middlewares/passport"; import passportMiddleware from "@server/middlewares/passport";
import { getAllowedDomains } from "@server/utils/authentication"; import { isDomainAllowed } from "@server/utils/authentication";
import { StateStore } from "@server/utils/passport"; import { StateStore } from "@server/utils/passport";
const router = new Router(); const router = new Router();
const providerName = "google"; const providerName = "google";
const GOOGLE_CLIENT_ID = process.env.GOOGLE_CLIENT_ID; const GOOGLE_CLIENT_ID = process.env.GOOGLE_CLIENT_ID;
const GOOGLE_CLIENT_SECRET = process.env.GOOGLE_CLIENT_SECRET; const GOOGLE_CLIENT_SECRET = process.env.GOOGLE_CLIENT_SECRET;
const allowedDomains = getAllowedDomains();
const scopes = [ const scopes = [
"https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/userinfo.profile",
"https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/userinfo.email",
@@ -48,7 +47,7 @@ if (GOOGLE_CLIENT_ID) {
throw GoogleWorkspaceRequiredError(); throw GoogleWorkspaceRequiredError();
} }
if (allowedDomains.length && !allowedDomains.includes(domain)) { if (!isDomainAllowed(domain)) {
throw GoogleWorkspaceInvalidError(); throw GoogleWorkspaceInvalidError();
} }

5
server/routes/auth/providers/oidc.ts
View File

@@ -9,7 +9,7 @@ import {
AuthenticationError, AuthenticationError,
} from "@server/errors"; } from "@server/errors";
import passportMiddleware from "@server/middlewares/passport"; import passportMiddleware from "@server/middlewares/passport";
import { getAllowedDomains } from "@server/utils/authentication"; import { isDomainAllowed } from "@server/utils/authentication";
import { StateStore, request } from "@server/utils/passport"; import { StateStore, request } from "@server/utils/passport";
const router = new Router(); const router = new Router();
@@ -23,7 +23,6 @@ const OIDC_USERINFO_URI = process.env.OIDC_USERINFO_URI || "";
const OIDC_SCOPES = process.env.OIDC_SCOPES || ""; const OIDC_SCOPES = process.env.OIDC_SCOPES || "";
const OIDC_USERNAME_CLAIM = const OIDC_USERNAME_CLAIM =
process.env.OIDC_USERNAME_CLAIM || "preferred_username"; process.env.OIDC_USERNAME_CLAIM || "preferred_username";
const allowedDomains = getAllowedDomains();
export const config = { export const config = {
name: OIDC_DISPLAY_NAME, name: OIDC_DISPLAY_NAME,
@@ -84,7 +83,7 @@ if (OIDC_CLIENT_ID) {
throw OIDCMalformedUserInfoError(); throw OIDCMalformedUserInfoError();
} }
if (allowedDomains.length && !allowedDomains.includes(domain)) { if (!isDomainAllowed(domain)) {
throw AuthenticationError( throw AuthenticationError(
`Domain ${domain} is not on the whitelist` `Domain ${domain} is not on the whitelist`
); );

5
server/utils/authentication.ts
View File

@@ -12,6 +12,11 @@ export function getAllowedDomains(): string[] {
return env ? env.split(",") : []; return env ? env.split(",") : [];
} }
export function isDomainAllowed(domain: string): boolean {
const allowedDomains = getAllowedDomains();
return allowedDomains.includes(domain) || allowedDomains.length === 0;
}
export async function signIn( export async function signIn(
ctx: Context, ctx: Context,
user: User, user: User,