Skip to content

Commit e1c6dc8

Browse files
javutojavuto
authored
Merge pull request #592 from jmpsec/check-uuid-len-tls
Prevent abuse of `osctrl-tls` public endpoints
2 parents c83d76e + 9fe845b commit e1c6dc8

File tree

3 files changed

+97
-0
lines changed

3 files changed

+97
-0
lines changed

‎tls/handlers/post.go‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,12 @@ func (h *HandlersTLS) EnrollHandler(w http.ResponseWriter, r *http.Request) {
3030
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
3131
return
3232
}
33+
// To prevent abuse, check if the received UUID is valid
34+
if !utils.CheckUUID(envVar) {
35+
h.Inc(metricEnrollErr)
36+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
37+
return
38+
}
3339
// Get environment
3440
env, err := h.Envs.GetByUUID(envVar)
3541
if err != nil {
@@ -121,6 +127,12 @@ func (h *HandlersTLS) ConfigHandler(w http.ResponseWriter, r *http.Request) {
121127
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
122128
return
123129
}
130+
// To prevent abuse, check if the received UUID is valid
131+
if !utils.CheckUUID(envVar) {
132+
h.Inc(metricConfigErr)
133+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
134+
return
135+
}
124136
// Get environment
125137
env, err := h.Envs.GetByUUID(envVar)
126138
if err != nil {
@@ -187,6 +199,12 @@ func (h *HandlersTLS) LogHandler(w http.ResponseWriter, r *http.Request) {
187199
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
188200
return
189201
}
202+
// To prevent abuse, check if the received UUID is valid
203+
if !utils.CheckUUID(envVar) {
204+
h.Inc(metricLogErr)
205+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
206+
return
207+
}
190208
// Get environment
191209
env, err := h.Envs.GetByUUID(envVar)
192210
if err != nil {
@@ -272,6 +290,12 @@ func (h *HandlersTLS) QueryReadHandler(w http.ResponseWriter, r *http.Request) {
272290
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
273291
return
274292
}
293+
// To prevent abuse, check if the received UUID is valid
294+
if !utils.CheckUUID(envVar) {
295+
h.Inc(metricReadErr)
296+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
297+
return
298+
}
275299
// Get environment
276300
env, err := h.Envs.GetByUUID(envVar)
277301
if err != nil {
@@ -352,6 +376,12 @@ func (h *HandlersTLS) QueryWriteHandler(w http.ResponseWriter, r *http.Request)
352376
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
353377
return
354378
}
379+
// To prevent abuse, check if the received UUID is valid
380+
if !utils.CheckUUID(envVar) {
381+
h.Inc(metricWriteErr)
382+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
383+
return
384+
}
355385
// Get environment
356386
env, err := h.Envs.GetByUUID(envVar)
357387
if err != nil {
@@ -432,6 +462,12 @@ func (h *HandlersTLS) QuickEnrollHandler(w http.ResponseWriter, r *http.Request)
432462
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
433463
return
434464
}
465+
// To prevent abuse, check if the received UUID is valid
466+
if !utils.CheckUUID(envVar) {
467+
h.Inc(metricOnelinerErr)
468+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
469+
return
470+
}
435471
// Get environment
436472
env, err := h.Envs.GetByUUID(envVar)
437473
if err != nil {
@@ -509,6 +545,12 @@ func (h *HandlersTLS) QuickRemoveHandler(w http.ResponseWriter, r *http.Request)
509545
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
510546
return
511547
}
548+
// To prevent abuse, check if the received UUID is valid
549+
if !utils.CheckUUID(envVar) {
550+
h.Inc(metricOnelinerErr)
551+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
552+
return
553+
}
512554
// Get environment
513555
env, err := h.Envs.GetByUUID(envVar)
514556
if err != nil {
@@ -588,6 +630,12 @@ func (h *HandlersTLS) CarveInitHandler(w http.ResponseWriter, r *http.Request) {
588630
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
589631
return
590632
}
633+
// To prevent abuse, check if the received UUID is valid
634+
if !utils.CheckUUID(envVar) {
635+
h.Inc(metricInitErr)
636+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
637+
return
638+
}
591639
// Get environment
592640
env, err := h.Envs.GetByUUID(envVar)
593641
if err != nil {
@@ -660,6 +708,12 @@ func (h *HandlersTLS) CarveBlockHandler(w http.ResponseWriter, r *http.Request)
660708
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
661709
return
662710
}
711+
// To prevent abuse, check if the received UUID is valid
712+
if !utils.CheckUUID(envVar) {
713+
h.Inc(metricBlockErr)
714+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
715+
return
716+
}
663717
// Get environment
664718
env, err := h.Envs.GetByUUID(envVar)
665719
if err != nil {
@@ -721,6 +775,12 @@ func (h *HandlersTLS) FlagsHandler(w http.ResponseWriter, r *http.Request) {
721775
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
722776
return
723777
}
778+
// To prevent abuse, check if the received UUID is valid
779+
if !utils.CheckUUID(envVar) {
780+
h.Inc(metricFlagsErr)
781+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
782+
return
783+
}
724784
// Get environment
725785
env, err := h.Envs.GetByUUID(envVar)
726786
if err != nil {
@@ -781,6 +841,12 @@ func (h *HandlersTLS) CertHandler(w http.ResponseWriter, r *http.Request) {
781841
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
782842
return
783843
}
844+
// To prevent abuse, check if the received UUID is valid
845+
if !utils.CheckUUID(envVar) {
846+
h.Inc(metricCertErr)
847+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
848+
return
849+
}
784850
// Get environment
785851
env, err := h.Envs.GetByUUID(envVar)
786852
if err != nil {
@@ -834,6 +900,12 @@ func (h *HandlersTLS) VerifyHandler(w http.ResponseWriter, r *http.Request) {
834900
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
835901
return
836902
}
903+
// To prevent abuse, check if the received UUID is valid
904+
if !utils.CheckUUID(envVar) {
905+
h.Inc(metricVerifyErr)
906+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
907+
return
908+
}
837909
// Get environment
838910
env, err := h.Envs.GetByUUID(envVar)
839911
if err != nil {
@@ -898,6 +970,12 @@ func (h *HandlersTLS) ScriptHandler(w http.ResponseWriter, r *http.Request) {
898970
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
899971
return
900972
}
973+
// To prevent abuse, check if the received UUID is valid
974+
if !utils.CheckUUID(envVar) {
975+
h.Inc(metricScriptErr)
976+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
977+
return
978+
}
901979
// Get environment
902980
env, err := h.Envs.GetByUUID(envVar)
903981
if err != nil {
@@ -988,6 +1066,12 @@ func (h *HandlersTLS) EnrollPackageHandler(w http.ResponseWriter, r *http.Reques
9881066
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
9891067
return
9901068
}
1069+
// To prevent abuse, check if the received UUID is valid
1070+
if !utils.CheckUUID(envVar) {
1071+
h.Inc(metricPackageErr)
1072+
utils.HTTPResponse(w, "", http.StatusBadRequest, []byte(""))
1073+
return
1074+
}
9911075
// Get environment
9921076
env, err := h.Envs.GetByUUID(envVar)
9931077
if err != nil {

‎utils/string-utils.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,15 @@ func GenUUID() string {
3636
return uuid.New().String()
3737
}
3838

39+
// CheckUUID - Helper to check if a string is a valid UUID
40+
func CheckUUID(s string) bool {
41+
_, err := uuid.Parse(s)
42+
if err != nil {
43+
return false
44+
}
45+
return true
46+
}
47+
3948
// StringToInteger - Helper to convert a string into integer
4049
func StringToInteger(s string) int64 {
4150
v, err := strconv.ParseInt(s, 10, 64)

‎utils/string-utils_test.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ func TestGenUUID(t *testing.T) {
2121
assert.NotEmpty(t, GenUUID())
2222
}
2323

24+
func TestCheckUUID(t *testing.T) {
25+
assert.True(t, CheckUUID(GenUUID()))
26+
}
27+
2428
func TestStringToInteger(t *testing.T) {
2529
assert.Equal(t, int64(123), StringToInteger("123"))
2630
}

0 commit comments

Comments
 (0)