Sanitize incoming urls everywhere.

Authress · Jan 22, 2024 · 0901e19 · 0901e19
1 parent ad03547
commit 0901e19
Show file tree

Hide file tree

Showing 5 changed files with 17 additions and 7 deletions.
diff --git a/src/Authress.SDK/Client/AuthressClientTokenProvider.cs b/src/Authress.SDK/Client/AuthressClientTokenProvider.cs
@@ -7,6 +7,7 @@
 using System.Text;
 using System.Threading.Tasks;
 using System.Web;
+using Authress.SDK.Utilities;
 using Microsoft.IdentityModel.Tokens;
 using Newtonsoft.Json;
 using NSec.Cryptography;
@@ -68,8 +69,8 @@ public AuthressClientTokenProvider(string accessKeyBase64, string authressCustom
 
         private string GetIssuer(string authressCustomDomainFallback = null)
         {
-            var rawDomain = (this.authressCustomDomain ?? authressCustomDomainFallback ?? resolvedAuthressCustomDomain).Replace("https://", "");
-            return $"https://{rawDomain}/v1/clients/{System.Web.HttpUtility.UrlEncode(this.accessKey.ClientId)}";
+            var rawDomain = Sanitizers.SanitizeUrl(this.authressCustomDomain ?? authressCustomDomainFallback ?? resolvedAuthressCustomDomain);
+            return $"{rawDomain}/v1/clients/{System.Web.HttpUtility.UrlEncode(this.accessKey.ClientId)}";
         }
 
         private static SigningCredentials GetSigningCredentials(string pem, string keyId)

diff --git a/src/Authress.SDK/Client/HttpClientProvider.cs b/src/Authress.SDK/Client/HttpClientProvider.cs
@@ -2,6 +2,7 @@
 using System.Net.Http;
 using System.Threading;
 using System.Threading.Tasks;
+using Authress.SDK.Utilities;
 
 namespace Authress.SDK.Client
 {
@@ -37,10 +38,16 @@ public class HttpClientSettings
     /// </summary>
     public class AuthressSettings
     {
+        private string apiBasePath = "https://api.authress.io";
         /// <summary>
         /// Authress Domain Host: https://authress.company.com (Get an authress custom domain: https://authress.io/app/#/settings?focus=domain)
         /// </summary>
-        public string ApiBasePath { get; set; } = "https://api.authress.io";
+        public string ApiBasePath {
+            get { return apiBasePath; }
+            set {
+                apiBasePath = Sanitizers.SanitizeUrl(value);
+            }
+        }
 
         /// <summary>
         /// Timeout for requests to Authress. Default is unset.
@@ -169,8 +176,9 @@ internal class RewriteBaseUrlHandler : DelegatingHandler
     {
         private readonly Uri baseUrl;
 
-        public RewriteBaseUrlHandler(HttpMessageHandler innerHandler, string baseUrl) : base(innerHandler)
+        public RewriteBaseUrlHandler(HttpMessageHandler innerHandler, string originalBaseUrl) : base(innerHandler)
         {
+            var baseUrl = Sanitizers.SanitizeUrl(originalBaseUrl);
             this.baseUrl = new Uri(baseUrl.EndsWith("/") ? baseUrl : baseUrl + "/");
         }
 

diff --git a/src/Authress.SDK/Client/TokenVerifier.cs b/src/Authress.SDK/Client/TokenVerifier.cs
@@ -196,7 +196,7 @@ private VerifiedUserIdentity VerifySignature(string jwtToken, Jwk key) {
                     case 3: jwtTokenSignature += "="; break;
                 }
 
-                var edDsaPublicKey = NSec.Cryptography.PublicKey.Import(ed25519alg, Convert.FromBase64String(keyAsString), KeyBlobFormat.PkixPublicKey);
+                var edDsaPublicKey = NSec.Cryptography.PublicKey.Import(ed25519alg, Convert.FromBase64String("MCowBQYDK2VwAyEA" + keyAsString), KeyBlobFormat.PkixPublicKey);
                 var signatureData = Convert.FromBase64String(jwtTokenSignature);
                 if (!SignatureAlgorithm.Ed25519.Verify(edDsaPublicKey, data, signatureData)) {
                     throw new TokenVerificationException($"Unauthorized: Token Signature is not valid.");

diff --git a/src/Authress.SDK/Utilities/Sanitizers.cs b/src/Authress.SDK/Utilities/Sanitizers.cs
@@ -13,7 +13,7 @@ internal static string SanitizeUrl(string urlString) {
             }
 
             if (Regex.IsMatch(urlString, @"^localhost", RegexOptions.IgnoreCase)) {
-                return "http://{url}";
+                return $"http://{urlString}";
             }
 
             return $"https://{urlString}";

diff --git a/tests/Authress.SDK/Client/Tokenverifier/VerifyTokenTests.cs b/tests/Authress.SDK/Client/Tokenverifier/VerifyTokenTests.cs
@@ -29,7 +29,8 @@ public class VerifyTokenTests
     {
 
         private static string authressCustomDomain = "https://unit-test-customdomain.authress.io";
-        private static (string, string) eddsaKeys = ("MC4CAQAwBQYDK2VwBCIEIHWOlqpfN1YdPSAvAZlSxOyZs0v0jnOj3flvG4ezJ8/R", "MCowBQYDK2VwAyEAP1ghjuexanmp5hYgSYRvbFJirquynaCyolH3vHb9JCE=");
+        // Prefix MCowBQYDK2VwAyEA is inferred by the configuration of the JWK
+        private static (string, string) eddsaKeys = ("MC4CAQAwBQYDK2VwBCIEIHWOlqpfN1YdPSAvAZlSxOyZs0v0jnOj3flvG4ezJ8/R", "P1ghjuexanmp5hYgSYRvbFJirquynaCyolH3vHb9JCE=");
 
         [Fact]
         public async Task ValidateEddsaToken() {