Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit4439a92

Browse files
authored
Merge pull request fromGHSA-7cc2-r658-7xpf
This fixes a vulnerability with the `CODER_OIDC_EMAIL_DOMAIN` option,where users with a superset of the allowed email domain would be allowedto login. For example, given `CODER_OIDC_EMAIL_DOMAIN=google.com`, auser would be permitted entry if their email domain was`colin-google.com`.
1 parent8f190b2 commit4439a92

File tree

2 files changed

+21
-2
lines changed

2 files changed

+21
-2
lines changed

‎coderd/userauth.go

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -929,15 +929,23 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
929929

930930
iflen(api.OIDCConfig.EmailDomain)>0 {
931931
ok=false
932+
emailSp:=strings.Split(email,"@")
933+
iflen(emailSp)==1 {
934+
httpapi.Write(ctx,rw,http.StatusForbidden, codersdk.Response{
935+
Message:fmt.Sprintf("Your email %q is not in domains %q!",email,api.OIDCConfig.EmailDomain),
936+
})
937+
return
938+
}
939+
userEmailDomain:=emailSp[len(emailSp)-1]
932940
for_,domain:=rangeapi.OIDCConfig.EmailDomain {
933-
ifstrings.HasSuffix(strings.ToLower(email),strings.ToLower(domain)) {
941+
ifstrings.EqualFold(userEmailDomain,domain) {
934942
ok=true
935943
break
936944
}
937945
}
938946
if!ok {
939947
httpapi.Write(ctx,rw,http.StatusForbidden, codersdk.Response{
940-
Message:fmt.Sprintf("Your email %q is not in domains %q!",email,api.OIDCConfig.EmailDomain),
948+
Message:fmt.Sprintf("Your email %q is not in domains %q!",email,api.OIDCConfig.EmailDomain),
941949
})
942950
return
943951
}

‎coderd/userauth_test.go

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -798,6 +798,17 @@ func TestUserOIDC(t *testing.T) {
798798
"kwc.io",
799799
},
800800
StatusCode:http.StatusOK,
801+
}, {
802+
Name:"EmailDomainSubset",
803+
IDTokenClaims: jwt.MapClaims{
804+
"email":"colin@gmail.com",
805+
"email_verified":true,
806+
},
807+
AllowSignups:true,
808+
EmailDomain: []string{
809+
"mail.com",
810+
},
811+
StatusCode:http.StatusForbidden,
801812
}, {
802813
Name:"EmptyClaims",
803814
IDTokenClaims: jwt.MapClaims{},

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp