Merge pull request #8 from searchspring/add-whitelist

add whitelist for redirect urls

Author: korgon

Makefile

@@ -42,6 +42,7 @@ docker-run:
 		-e GITHUB_REDIRECT_URL="${GITHUB_REDIRECT_URL}" \
 		-e GITHUB_CLIENT_ID="${GITHUB_CLIENT_ID}" \
 		-e GITHUB_CLIENT_SECRET="${GITHUB_CLIENT_SECRET}" \
+		-e ALLOWLIST_REDIRECT_URLS="${ALLOWLIST_REDIRECT_URLS}" \
 		-p 3000:3000 \
 		github-token-exchange:latest
 .PHONY: docker-run

README.md

@@ -13,6 +13,7 @@ Create a `.env` file and add the values:
 GITHUB_CLIENT_SECRET=*** find the secret in 1password ***
 GITHUB_CLIENT_ID=e02c8965ff92aa84b6ee
 GITHUB_REDIRECT_URL=http://localhost:3000
+ALLOWLIST_REDIRECT_URLS=http://localhost,https://localhost,https://searchspring.github.io/snapp-explorer
 ```
 
 Run the docker build
@@ -43,4 +44,5 @@ make run
 GITHUB_CLIENT_SECRET=*** find the secret in 1password ***
 GITHUB_CLIENT_ID=5df635731e7fa3513c1d
 GITHUB_REDIRECT_URL=https://token.kube.searchspring.io
+ALLOWLIST_REDIRECT_URLS=http://localhost,https://localhost,https://searchspring.github.io/snapp-explorer
 ```

kubernetes/github-token-exchange/base/configmap.yml

@@ -6,4 +6,5 @@ metadata:
 data:
   GITHUB_CLIENT_ID: 5df635731e7fa3513c1d
   GITHUB_REDIRECT_URL: https://token.kube.searchspring.io
+  ALLOWLIST_REDIRECT_URLS: "http://localhost,https://localhost,https://searchspring.github.io/snapp-explorer"
   PORT: "3000"

main.go

@@ -5,6 +5,8 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"regexp"
+	"strings"
 
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
@@ -44,6 +46,9 @@ func checks() {
 	if os.Getenv("GITHUB_CLIENT_SECRET") == "" {
 		panic("must set GITHUB_CLIENT_SECRET variable")
 	}
+	if os.Getenv("ALLOWLIST_REDIRECT_URLS") == "" {
+		panic("must set ALLOWLIST_REDIRECT_URLS variable")
+	}
 }
 
 func handler(w http.ResponseWriter, r *http.Request) {
@@ -62,17 +67,37 @@ func handler(w http.ResponseWriter, r *http.Request) {
 	clientID := os.Getenv("GITHUB_CLIENT_ID")
 	clientSecret := os.Getenv("GITHUB_CLIENT_SECRET")
 	redirectURL := os.Getenv("GITHUB_REDIRECT_URL")
+	allowlistString := os.Getenv("ALLOWLIST_REDIRECT_URLS")
 
 	user, err := githubDAO.GetUser(clientID, clientSecret, code, redirectURL)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusForbidden)
 		opsFailed.Inc()
 		return
 	}
+
+	allowlist := strings.Split(allowlistString, ",")
+	url := "http://localhost:3827"
+	requestedRedirectURL := r.URL.Query().Get("redirect")
+
+	if (len(requestedRedirectURL) > 0) {
+		// check if in allowlist
+		for _, entry := range allowlist {
+			entry = strings.TrimSpace(entry)
+			if(len(entry) > 0) {
+				match, _ := regexp.MatchString("^" + entry, requestedRedirectURL)
+				if(match) {
+					url = requestedRedirectURL
+					break
+				}
+			}
+		}
+	}
+
 	html := `
 		<script>
 			let user = ` + string(user) + `
-			window.location.href = 'http://localhost:3827/?user=' + encodeURIComponent(JSON.stringify(user))
+			window.location.href = '` + string(url) + `' + '?user=' + encodeURIComponent(JSON.stringify(user))
 		</script>
 		`
 	_, err = w.Write([]byte(html))

main_test.go

@@ -72,6 +72,7 @@ func TestChecks(t *testing.T) {
 	os.Setenv("GITHUB_CLIENT_SECRET", "")
 	os.Setenv("GITHUB_CLIENT_ID", "")
 	os.Setenv("GITHUB_REDIRECT_URL", "")
+	os.Setenv("ALLOWLIST_REDIRECT_URLS", "")
 	testFail(t)
 
 	os.Setenv("PORT", "8888")
@@ -80,6 +81,30 @@ func TestChecks(t *testing.T) {
 	testFail(t)
 	os.Setenv("GITHUB_CLIENT_ID", "aoeu")
 	testFail(t)
+	os.Setenv("ALLOWLIST_REDIRECT_URLS", "http://localhost,https://localhost,https://searchspring.github.io/snapp-explorer")
+	testFail(t)
+	os.Setenv("ALLOWLIST_REDIRECT_URLS", "http://localhost,https://localhost ,  https://searchspring.github.io/snapp-explorer, ")
+	testFail(t)
+}
+
+func TestAllowlistPass(t *testing.T) {
+	githubDAO = &mockDAO{Override: simple}
+	res := httptest.NewRecorder()
+	handler(res, httptest.NewRequest("GET", "http://localhost:1231/?code=blah&redirect=https://searchspring.github.io/snapp-explorer", nil))
+	body, err := ioutil.ReadAll(res.Body)
+	require.Nil(t, err)
+	require.True(t, strings.Contains(string(body), "https://searchspring.github.io/snapp-explorer"))
+	require.False(t, strings.Contains(string(body), "http://localhost:3827"))
+}
+
+func TestAllowlistFail(t *testing.T) {
+	githubDAO = &mockDAO{Override: simple}
+	res := httptest.NewRecorder()
+	handler(res, httptest.NewRequest("GET", "http://localhost:1231/?code=blah&redirect=https://dne.searchspring.io", nil))
+	body, err := ioutil.ReadAll(res.Body)
+	require.Nil(t, err)
+	require.True(t, strings.Contains(string(body), "http://localhost:3827"))
+	require.False(t, strings.Contains(string(body), "https://dne.searchspring.io"))
 }
 
 func testFail(t *testing.T) {