sophie/nuke
1
0
Fork 0
Code Packages 1 Activity Actions

fix(lib): close open redirect when in subrequest mode (#1222)

Browse source 
* test(nginx-external-auth): bring up to code standards

Signed-off-by: Xe Iaso <me@xeiaso.net>

* fix(lib): close open redirect when in subrequest mode

Closes GHSA-cf57-c578-7jvv

Previously Anubis had an open redirect in subrequest auth mode due to an
insufficent fix in GHSA-jhjj-2g64-px7c. This patch adds additional
validation at several steps of the flow to prevent open redirects in
subrequest auth mode as well as implements automated testing to prevent
this from occuring in the future.

* docs: update CHANGELOG

Signed-off-by: Xe Iaso <me@xeiaso.net>

---------

Signed-off-by: Xe Iaso <me@xeiaso.net>
This commit is contained in:
Xe Iaso 2025-10-29 16:07:31 -04:00 • committed by GitHub
parent 3dab060bfa
commit 7ed1753fcc
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 384 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

16
test/nginx-external-auth/start.sh
View file

@ -4,20 +4,20 @@ set -euo pipefail
# Build container image
(
cd ../.. \
&& npm ci \
&& npm run container -- \
--docker-repo ttl.sh/techaro/anubis-external-auth \
--docker-tags ttl.sh/techaro/anubis-external-auth:latest
cd ../.. &&
npm ci &&
npm run container -- \
--docker-repo ttl.sh/techaro/anubis \
--docker-tags ttl.sh/techaro/anubis:latest
)
kubectl apply -k .
echo "open https://nginx.local.cetacean.club, press control c when done"
control_c() {
kubectl delete -k .
exit
kubectl delete -k .
exit
}
trap control_c SIGINT
sleep infinity
sleep infinity