File 0001-Add-query-parameter-validation-for-multipl... of Package aws-iam-authenticator.24996

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-Add-query-parameter-validation-for-multiple-parameters.patch of Package aws-iam-authenticator.24996

From c4a3a96e4adc131768166de0f6cc0e93dacbbfad Mon Sep 17 00:00:00 2001
From: Nick Turner <nic@amazon.com>
Date: Wed, 1 Jun 2022 16:46:25 -0700
Subject: [PATCH] Add query parameter validation for multiple parameters

---
 pkg/token/token.go      | 15 +++++++++++++++
 pkg/token/token_test.go |  1 +
 2 files changed, 16 insertions(+)

diff --git a/pkg/token/token.go b/pkg/token/token.go
index b6d1fbcd..70b6132e 100644
--- a/pkg/token/token.go
+++ b/pkg/token/token.go
@@ -473,6 +473,10 @@ func (v tokenVerifier) Verify(token string) (*Identity, error) {
 		return nil, FormatError{"malformed query parameter"}
 	}
 
+	if err = validateDuplicateParameters(queryParams); err != nil {
+		return nil, err
+	}
+
 	for key, values := range queryParams {
 		if !parameterWhitelist[strings.ToLower(key)] {
 			return nil, FormatError{fmt.Sprintf("non-whitelisted query parameter %q", key)}
@@ -576,6 +580,17 @@ func (v tokenVerifier) Verify(token string) (*Identity, error) {
 	return id, nil
 }
 
+func validateDuplicateParameters(queryParams url.Values) error {
+	duplicateCheck := make(map[string]bool)
+	for key, _ := range queryParams {
+		if _, found := duplicateCheck[strings.ToLower(key)]; found {
+			return FormatError{fmt.Sprintf("duplicate query parameter found: %q", key)}
+		}
+		duplicateCheck[strings.ToLower(key)] = true
+	}
+	return nil
+}
+
 func hasSignedClusterIDHeader(paramsLower *url.Values) bool {
 	signedHeaders := strings.Split(paramsLower.Get("x-amz-signedheaders"), ";")
 	for _, hdr := range signedHeaders {
diff --git a/pkg/token/token_test.go b/pkg/token/token_test.go
index c8e4e652..b67e9bf2 100644
--- a/pkg/token/token_test.go
+++ b/pkg/token/token_test.go
@@ -190,6 +190,7 @@ func TestVerifyTokenPreSTSValidations(t *testing.T) {
 	validationSuccessTest(t, "aws", toToken(fmt.Sprintf("https://sts.ca-central-1.amazonaws.com/?action=GetCallerIdentity&x-amz-signedheaders=x-k8s-aws-id&x-amz-date=%s&x-amz-expires=60", timeStr)))
 	validationSuccessTest(t, "aws", toToken(fmt.Sprintf("https://sts.eu-west-1.amazonaws.com/?action=GetCallerIdentity&x-amz-signedheaders=x-k8s-aws-id&x-amz-date=%s&x-amz-expires=60", timeStr)))
 	validationSuccessTest(t, "aws", toToken(fmt.Sprintf("https://sts.sa-east-1.amazonaws.com/?action=GetCallerIdentity&x-amz-signedheaders=x-k8s-aws-id&x-amz-date=%s&x-amz-expires=60", timeStr)))
+	validationErrorTest(t, "aws", toToken(fmt.Sprintf("https://sts.us-west-2.amazonaws.com/?Action=GetCallerIdentity&Version=2011-06-15&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAAAAAAAAAAAAAAAAA%%2F20220601%%2Fus-west-2%%2Fsts%%2Faws4_request&X-Amz-Date=%s&X-Amz-Expires=900&X-Amz-Security-Token=XXXXXXXXXXXXX&X-Amz-SignedHeaders=host%%3Bx-k8s-aws-id&x-amz-credential=eve&X-Amz-Signature=999999999999999999", timeStr)), "input token was not properly formatted: duplicate query parameter found:")
 }
 
 func TestVerifyHTTPError(t *testing.T) {
-- 
2.37.0

Places

File 0001-Add-query-parameter-validation-for-multiple-parameters.patch of Package aws-iam-authenticator.24996

Places