jcoffey-dev
4b5dae5879
This is a large squashed commit covering two batches of prior uncommitted work plus a full security-audit remediation pass, kept together because go.mod/go.sum and several shared files (main.go, handler.go) were touched by both and splitting risked non-building intermediate commits. Features (built earlier, previously uncommitted): - Local username/password login for single-tenant deployments with no SSO configured (api/localauth, alerting/internal/sessioncheck, sentryctl users, web/src/routes/login, metadata migrations 0040/0041). - Remotely-editable additional log file paths for agents, on top of their existing primary source (api/agents, agent/sentry-agent extra-file-path diffing, web agent config UI). - IPv4/IPv6 addresses reported alongside other host system metrics. Security audit remediation (this pass, all live-verified in production): - Critical: block ClickHouse SSRF table functions (url/remote/file/s3/...) in the raw-SQL query escape hatch. - High: deny sensitive paths and require Admin to add agent extra_file_paths (Editor could previously point an agent at /etc/shadow or an SSH key); alerting webhook targets now validate against internal/metadata/loopback addresses, both at creation and send time; alerting's session middleware now enforces an Editor+ floor on mutating requests instead of "any authenticated session"; bumped goxmldsig to close a SAML signature-verification bypass (GO-2026-4753). - Medium: per-IP login rate limiting; security response headers (HSTS/CSP/nosniff/X-Frame-Options/Referrer-Policy/Permissions-Policy) on web/nginx.conf; a DevCredentialWarnings check in every Go service's config loader, logging loudly at startup if a deployment is still on docker-compose.yml's literal dev-only credentials; dependency bumps (golang.org/x/text, grpc, x/net, quick-xml, h2) across every affected Go module and both Rust crates, including a previously-uncovered x/net vulnerability in deploy/operator; a new security-scan.yml CI workflow running cargo-deny/govulncheck/npm-audit, mirroring the existing license-compliance.yml matrix shape. - Low: removed sentryctl's plaintext --password flag (shell history/`ps` exposure) in favor of stdin and a --password-stdin flag for reset-password's optional specific-password path; a dummy bcrypt comparison closes a login response-time username-enumeration side-channel.
71 lines
2.4 KiB
Go
71 lines
2.4 KiB
Go
package localauth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"net/http"
|
|
|
|
"github.com/sentry/sentry/api/authz"
|
|
)
|
|
|
|
// sessionStore is the narrow interface Authorizer depends on -- *Store
|
|
// is the production implementation; tests use a fake.
|
|
type sessionStore interface {
|
|
GetSession(ctx context.Context, tokenHash string) (*Session, error)
|
|
}
|
|
|
|
// sessionCookieName is also read directly by handler.go (Set-Cookie on
|
|
// login/logout) and is the one piece of this package's shape web/
|
|
// needs to know about implicitly (via credentials: 'include', not by
|
|
// name -- the browser handles the cookie, JS never reads it since it's
|
|
// HttpOnly).
|
|
const sessionCookieName = "sentry_local_session"
|
|
|
|
// Authorizer implements api/authz.Authorizer against local_sessions --
|
|
// wiring a non-nil *Authorizer into api/cmd/api/main.go's authorizer
|
|
// variable is what turns every existing RequireRole-wrapped route in
|
|
// dashboards/agents/queryapi/aiapi from a no-op into real enforcement,
|
|
// with no changes needed to any of those handler files (see this
|
|
// package's doc comment).
|
|
type Authorizer struct {
|
|
store sessionStore
|
|
}
|
|
|
|
func NewAuthorizer(store sessionStore) *Authorizer {
|
|
return &Authorizer{store: store}
|
|
}
|
|
|
|
var errNoCredential = errors.New("localauth: no session credential presented")
|
|
|
|
// Authorize checks Authorization: Bearer first (sentryctl and other
|
|
// non-browser callers), then the session cookie (the web UI) -- same
|
|
// precedence authz.HTTPAuthorizer's caller-side forwarding implies,
|
|
// and the same reason POST /auth/login's response body returns the raw
|
|
// token alongside setting the cookie (see handler.go): one opaque
|
|
// value works both ways.
|
|
func (a *Authorizer) Authorize(r *http.Request) (authz.Identity, error) {
|
|
raw, err := credentialFromRequest(r)
|
|
if err != nil {
|
|
return authz.Identity{}, err
|
|
}
|
|
|
|
sess, err := a.store.GetSession(r.Context(), hashToken(raw))
|
|
if err != nil {
|
|
return authz.Identity{}, err
|
|
}
|
|
return authz.Identity{TenantID: sess.TenantID, UserID: sess.UserID, Role: sess.Role}, nil
|
|
}
|
|
|
|
func credentialFromRequest(r *http.Request) (string, error) {
|
|
if auth := r.Header.Get("Authorization"); auth != "" {
|
|
const prefix = "Bearer "
|
|
if len(auth) > len(prefix) && auth[:len(prefix)] == prefix {
|
|
return auth[len(prefix):], nil
|
|
}
|
|
}
|
|
if cookie, err := r.Cookie(sessionCookieName); err == nil && cookie.Value != "" {
|
|
return cookie.Value, nil
|
|
}
|
|
return "", errNoCredential
|
|
}
|