mylesmarkevich/standardnotes-server
1
0
Fork 0
mirror of https://github.com/standardnotes/server synced 2026-10-12 06:13:10 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: Prevents path injection on subscription tokens endpoints

Browse Source
This commit is contained in:
Antonella Sgarlatta
2026-10-05 14:33:46 -03:00
committed by Antonella Sgarlatta
parent ef62494b15
commit 8a11c29cce
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/api-gateway/src/Controller/SubscriptionTokenAuthMiddleware.ts
+11 -3
View File
@@ -44,11 +44,19 @@ export class SubscriptionTokenAuthMiddleware extends BaseMiddleware {
} as SubscriptionResponseLocals
Object.assign(response.locals, locals)
if (typeof subscriptionToken !== 'string' || !/^[a-f0-9]+$/i.test(subscriptionToken)) {
response.status(401).send({ error: { tag: 'invalid-auth', message: 'Invalid login credentials.' } })
return
}
const encodedSubscriptionToken = encodeURIComponent(subscriptionToken)
try {
const url =
locals.tokenAuthenticationMethod == TokenAuthenticationMethod.OfflineSubscriptionToken
? `${this.authServerUrl}/offline/subscription-tokens/${subscriptionToken}/validate`
: `${this.authServerUrl}/subscription-tokens/${subscriptionToken}/validate`
? `${this.authServerUrl}/offline/subscription-tokens/${encodedSubscriptionToken}/validate`
: `${this.authServerUrl}/subscription-tokens/${encodedSubscriptionToken}/validate`
const authResponse = await this.httpClient.request({
method: 'POST',
@@ -86,7 +94,7 @@ export class SubscriptionTokenAuthMiddleware extends BaseMiddleware {
: (error as Error).message
this.logger.error(
`Could not pass the request to ${this.authServerUrl}/subscription-tokens/${subscriptionToken}/validate on underlying service: ${errorMessage}`,
`Could not pass the request to ${this.authServerUrl}/subscription-tokens/${encodedSubscriptionToken}/validate on underlying service: ${errorMessage}`,
)
this.logger.debug('Response error: %O', (error as AxiosError).response ?? error)