Something went wrong. Try again.
sloproxy
Something went wrong. Try again.
15 kB · 471 lines
Go
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472package pluginstore
import ( "encoding/base64" "fmt" "net/http" "net/url" "os" "strings" "time")
const ( RequestKindRegistry = "registry" RequestKindMetadata = "metadata" RequestKindArtifact = "artifact"
AuthTypeNone = "none" AuthTypeBearer = "bearer" AuthTypeBasic = "basic" AuthTypeHeader = "header" AuthTypeGitHubToken = "github-token")
type AuthConfig struct { Match string `yaml:"match,omitempty" json:"match,omitempty"` ApplyTo []string `yaml:"apply-to,omitempty" json:"apply_to,omitempty"` Type string `yaml:"type,omitempty" json:"type,omitempty"` TokenEnv string `yaml:"token-env,omitempty" json:"token_env,omitempty"` UsernameEnv string `yaml:"username-env,omitempty" json:"username_env,omitempty"` PasswordEnv string `yaml:"password-env,omitempty" json:"password_env,omitempty"` HeaderName string `yaml:"header-name,omitempty" json:"header_name,omitempty"` HeaderValueEnv string `yaml:"header-value-env,omitempty" json:"header_value_env,omitempty"` AllowInsecure bool `yaml:"allow-insecure,omitempty" json:"allow_insecure,omitempty"`}
// Secret holds short-lived credential material that can be overwritten after use.type Secret []byte
// Clear overwrites the secret and releases its backing slice reference.func (s *Secret) Clear() { if s == nil { return } for index := range *s { (*s)[index] = 0 } *s = nil}
type ResolvedAuthConfig struct { Match string `yaml:"match,omitempty" json:"match,omitempty"` ApplyTo []string `yaml:"apply-to,omitempty" json:"apply_to,omitempty"` Type string `yaml:"type,omitempty" json:"type,omitempty"` Token Secret `yaml:"token,omitempty" json:"token,omitempty"` Username Secret `yaml:"username,omitempty" json:"username,omitempty"` Password Secret `yaml:"password,omitempty" json:"password,omitempty"` HeaderName string `yaml:"header-name,omitempty" json:"header_name,omitempty"` HeaderValue Secret `yaml:"header-value,omitempty" json:"header_value,omitempty"`}
func (c *ResolvedAuthConfig) Clear() { if c == nil { return } c.Token.Clear() c.Username.Clear() c.Password.Clear() c.HeaderValue.Clear() c.ApplyTo = nil}
func ClearResolvedAuthConfigs(auth []ResolvedAuthConfig) { for index := range auth { auth[index].Clear() }}
func ResolvedAuthForRequest(auth []ResolvedAuthConfig, requestURL string, kind string) (ResolvedAuthConfig, bool) { item, ok := matchingResolvedAuthConfig(auth, requestURL, kind) if !ok { return ResolvedAuthConfig{}, false } return cloneResolvedAuthConfig(item), true}
func ValidateResolvedAuthConfig(item ResolvedAuthConfig) error { parsed, errParse := url.Parse(strings.TrimSpace(item.Match)) if errParse != nil || parsed.Scheme == "" || parsed.Host == "" { return fmt.Errorf("plugin store resolved auth match is invalid") } if !strings.EqualFold(parsed.Scheme, "https") { return fmt.Errorf("plugin store resolved auth match must use https") } if parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" { return fmt.Errorf("plugin store resolved auth match must not contain credentials, query, or fragment") } for _, kind := range item.ApplyTo { switch strings.ToLower(strings.TrimSpace(kind)) { case RequestKindRegistry, RequestKindMetadata, RequestKindArtifact: default: return fmt.Errorf("plugin store resolved auth has unsupported apply_to %q", kind) } } switch strings.ToLower(strings.TrimSpace(item.Type)) { case "", AuthTypeNone: return nil case AuthTypeBearer, AuthTypeGitHubToken: if len(item.Token) == 0 { return fmt.Errorf("plugin store resolved auth token is empty") } case AuthTypeBasic: if len(item.Username) == 0 || len(item.Password) == 0 { return fmt.Errorf("plugin store resolved basic auth is incomplete") } case AuthTypeHeader: if strings.TrimSpace(item.HeaderName) == "" || strings.ContainsAny(item.HeaderName, "\r\n:") { return fmt.Errorf("plugin store resolved auth header name is invalid") } if len(item.HeaderValue) == 0 || secretContainsCRLF(item.HeaderValue) { return fmt.Errorf("plugin store resolved auth header value is invalid") } default: return fmt.Errorf("unsupported plugin store resolved auth type %q", item.Type) } return nil}
func NormalizeAuthConfigs(auth []AuthConfig) []AuthConfig { if len(auth) == 0 { return nil } out := make([]AuthConfig, 0, len(auth)) for _, item := range auth { item.Match = strings.TrimSpace(item.Match) item.Type = strings.ToLower(strings.TrimSpace(item.Type)) item.TokenEnv = strings.TrimSpace(item.TokenEnv) item.UsernameEnv = strings.TrimSpace(item.UsernameEnv) item.PasswordEnv = strings.TrimSpace(item.PasswordEnv) item.HeaderName = strings.TrimSpace(item.HeaderName) item.HeaderValueEnv = strings.TrimSpace(item.HeaderValueEnv) if item.Type == "" { item.Type = AuthTypeNone } if item.Match == "" { continue } if len(item.ApplyTo) > 0 { applyTo := make([]string, 0, len(item.ApplyTo)) seen := map[string]struct{}{} for _, value := range item.ApplyTo { value = strings.ToLower(strings.TrimSpace(value)) if value == "" { continue } if _, exists := seen[value]; exists { continue } seen[value] = struct{}{} applyTo = append(applyTo, value) } item.ApplyTo = applyTo } out = append(out, item) } return out}
func AuthConfigured(auth []AuthConfig, requestURL string, kind string) bool { item, ok := matchingAuthConfig(auth, requestURL, kind) if !ok { return false } switch strings.ToLower(strings.TrimSpace(item.Type)) { case AuthTypeNone: return false case AuthTypeBearer, AuthTypeGitHubToken: return strings.TrimSpace(os.Getenv(item.TokenEnv)) != "" case AuthTypeBasic: return strings.TrimSpace(os.Getenv(item.UsernameEnv)) != "" && strings.TrimSpace(os.Getenv(item.PasswordEnv)) != "" case AuthTypeHeader: return item.HeaderName != "" && strings.TrimSpace(os.Getenv(item.HeaderValueEnv)) != "" default: return false }}
func PluginAuthConfigured(source Source, plugin Plugin, auth []AuthConfig) bool { if AuthConfigured(auth, source.URL, RequestKindRegistry) { return true } switch PluginInstallType(plugin) { case InstallTypeDirect: for _, artifact := range PluginArtifacts(plugin) { if AuthConfigured(auth, artifact.URL, RequestKindArtifact) { return true } } case InstallTypeGitHubRelease: return pluginGitHubReleaseAuthConfigured(plugin, auth) } return false}
func pluginGitHubReleaseAuthConfigured(plugin Plugin, auth []AuthConfig) bool { owner, repo, errRepository := GitHubRepositoryParts(plugin.Repository) if errRepository != nil { return false } releasesURL := fmt.Sprintf( "https://api.github.com/repos/%s/%s/releases/", url.PathEscape(owner), url.PathEscape(repo), ) return AuthConfigured(auth, releasesURL+"latest", RequestKindMetadata) || AuthConfigured(auth, releasesURL+"tags/", RequestKindMetadata)}
func applyPluginStoreAuth(headers http.Header, auth []AuthConfig, requestURL string, kind string) error { _, errApply := applyPluginStoreAuthForClient(headers, nil, auth, requestURL, kind) return errApply}
func applyPluginStoreAuthForClient(headers http.Header, resolved []ResolvedAuthConfig, auth []AuthConfig, requestURL string, kind string) (bool, error) { if item, ok := matchingResolvedAuthConfig(resolved, requestURL, kind); ok { applied, errApply := applyResolvedPluginStoreAuth(headers, item) return applied, errApply } item, ok := matchingAuthConfig(auth, requestURL, kind) if !ok { return false, nil } switch strings.ToLower(strings.TrimSpace(item.Type)) { case "", AuthTypeNone: return false, nil case AuthTypeBearer: token, errToken := envValueRequired(item.TokenEnv, "token-env") if errToken != nil { return false, errToken } headers.Set("Authorization", "Bearer "+token) case AuthTypeBasic: username, errUsername := envValueRequired(item.UsernameEnv, "username-env") if errUsername != nil { return false, errUsername } password, errPassword := envValueRequired(item.PasswordEnv, "password-env") if errPassword != nil { return false, errPassword } encoded := base64.StdEncoding.EncodeToString([]byte(username + ":" + password)) headers.Set("Authorization", "Basic "+encoded) case AuthTypeHeader: if strings.TrimSpace(item.HeaderName) == "" { return false, fmt.Errorf("plugin store auth missing header-name") } value, errValue := envValueRequired(item.HeaderValueEnv, "header-value-env") if errValue != nil { return false, errValue } headers.Set(item.HeaderName, value) case AuthTypeGitHubToken: token, errToken := envValueRequired(item.TokenEnv, "token-env") if errToken != nil { return false, errToken } headers.Set("Authorization", "Bearer "+token) default: return false, fmt.Errorf("unsupported plugin store auth type %q", item.Type) } return true, nil}
func applyResolvedPluginStoreAuth(headers http.Header, item ResolvedAuthConfig) (bool, error) { switch strings.ToLower(strings.TrimSpace(item.Type)) { case "", AuthTypeNone: return false, nil case AuthTypeBearer, AuthTypeGitHubToken: if len(item.Token) == 0 { return false, fmt.Errorf("plugin store resolved auth token is empty") } headers.Set("Authorization", "Bearer "+string(item.Token)) case AuthTypeBasic: if len(item.Username) == 0 || len(item.Password) == 0 { return false, fmt.Errorf("plugin store resolved basic auth is incomplete") } credential := make([]byte, 0, len(item.Username)+1+len(item.Password)) credential = append(credential, item.Username...) credential = append(credential, ':') credential = append(credential, item.Password...) encoded := base64.StdEncoding.EncodeToString(credential) for index := range credential { credential[index] = 0 } headers.Set("Authorization", "Basic "+encoded) case AuthTypeHeader: if strings.TrimSpace(item.HeaderName) == "" { return false, fmt.Errorf("plugin store resolved auth missing header-name") } if len(item.HeaderValue) == 0 { return false, fmt.Errorf("plugin store resolved auth header value is empty") } headers.Set(item.HeaderName, string(item.HeaderValue)) default: return false, fmt.Errorf("unsupported plugin store resolved auth type %q", item.Type) } return true, nil}
func validatePluginStoreRequestURL(auth []AuthConfig, requestURL string, kind string) error { parsed, errParse := url.Parse(strings.TrimSpace(requestURL)) if errParse != nil || parsed.Scheme == "" || parsed.Host == "" { return fmt.Errorf("invalid plugin store url") } if parsed.User != nil { return fmt.Errorf("plugin store url must not contain credentials") } if hasSensitiveQueryParameter(parsed) { return fmt.Errorf("plugin store url contains sensitive query parameter") } if strings.EqualFold(parsed.Scheme, "http") && !allowInsecurePluginStoreURL(auth, requestURL, kind) { return fmt.Errorf("insecure plugin store url requires matching allow-insecure auth rule") } return nil}
func allowInsecurePluginStoreURL(auth []AuthConfig, requestURL string, kind string) bool { item, ok := matchingAuthConfig(auth, requestURL, kind) return ok && item.AllowInsecure}
func validateResolvedAuthExpiry(auth []ResolvedAuthConfig, expiresAt time.Time, now time.Time, requestURL string, kind string) error { if expiresAt.IsZero() { return nil } if _, ok := matchingResolvedAuthConfig(auth, requestURL, kind); !ok { return nil } if !now.Before(expiresAt) { return fmt.Errorf("plugin store resolved auth expired") } return nil}
func matchingAuthConfig(auth []AuthConfig, requestURL string, kind string) (AuthConfig, bool) { requestURL = strings.TrimSpace(requestURL) kind = strings.ToLower(strings.TrimSpace(kind)) for _, item := range NormalizeAuthConfigs(auth) { if !pluginStoreURLMatchesAuthRule(requestURL, item.Match) { continue } if !authAppliesTo(item, kind) { continue } return item, true } return AuthConfig{}, false}
func matchingResolvedAuthConfig(auth []ResolvedAuthConfig, requestURL string, kind string) (ResolvedAuthConfig, bool) { requestURL = strings.TrimSpace(requestURL) kind = strings.ToLower(strings.TrimSpace(kind)) for _, item := range auth { if !pluginStoreURLMatchesAuthRule(requestURL, strings.TrimSpace(item.Match)) { continue } if !resolvedAuthAppliesTo(item, kind) { continue } return item, true } return ResolvedAuthConfig{}, false}
func resolvedAuthAppliesTo(item ResolvedAuthConfig, kind string) bool { if len(item.ApplyTo) == 0 { return true } for _, value := range item.ApplyTo { if strings.EqualFold(strings.TrimSpace(value), kind) { return true } } return false}
func cloneResolvedAuthConfig(item ResolvedAuthConfig) ResolvedAuthConfig { item.ApplyTo = append([]string(nil), item.ApplyTo...) item.Token = append(Secret(nil), item.Token...) item.Username = append(Secret(nil), item.Username...) item.Password = append(Secret(nil), item.Password...) item.HeaderValue = append(Secret(nil), item.HeaderValue...) return item}
func resolvedAuthConfigured(item ResolvedAuthConfig) bool { switch strings.ToLower(strings.TrimSpace(item.Type)) { case AuthTypeBearer, AuthTypeGitHubToken: return len(item.Token) > 0 case AuthTypeBasic: return len(item.Username) > 0 && len(item.Password) > 0 case AuthTypeHeader: return strings.TrimSpace(item.HeaderName) != "" && len(item.HeaderValue) > 0 default: return false }}
func secretContainsCRLF(secret Secret) bool { for _, value := range secret { if value == '\r' || value == '\n' { return true } } return false}
func pluginStoreURLMatchesAuthRule(requestURL string, matchURL string) bool { request, errRequest := url.Parse(strings.TrimSpace(requestURL)) if errRequest != nil || request.Scheme == "" || request.Host == "" { return false } rule, errRule := url.Parse(strings.TrimSpace(matchURL)) if errRule != nil || rule.Scheme == "" || rule.Host == "" { return false } if !strings.EqualFold(request.Scheme, rule.Scheme) || !strings.EqualFold(request.Host, rule.Host) { return false } return pluginStorePathMatchesAuthRule(request.Path, rule.Path)}
func pluginStorePathMatchesAuthRule(requestPath string, rulePath string) bool { if rulePath == "" || rulePath == "/" { return true } if requestPath == "" { requestPath = "/" } if requestPath == rulePath { return true } if strings.HasSuffix(rulePath, "/") { return strings.HasPrefix(requestPath, rulePath) } return strings.HasPrefix(requestPath, rulePath+"/")}
func authAppliesTo(item AuthConfig, kind string) bool { if len(item.ApplyTo) == 0 { return true } for _, value := range item.ApplyTo { if strings.EqualFold(strings.TrimSpace(value), kind) { return true } } return false}
func envValueRequired(envName string, field string) (string, error) { envName = strings.TrimSpace(envName) if envName == "" { return "", fmt.Errorf("plugin store auth missing %s", field) } value := strings.TrimSpace(os.Getenv(envName)) if value == "" { return "", fmt.Errorf("plugin store auth env %s is empty", envName) } return value, nil}