mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-10-12 04:04:26 +00:00
lukaszraczylo
2ff14556d0
Security/correctness fixes: - fail-open token validation preserved with lenient-audience; access token that fails verification and has no ID token to corroborate now fails closed - token_manager blacklist-expiry: fix impossible tautology (x>24h && x<24h) - constant-time OAuth state compare; clear state/nonce/code_verifier on callback token-exchange failure to prevent replay of half-failed flows - StopAllTasks gated on last-instance close - background-task panic recovery; remove task-registry counter leak - circuit breaker half-open: release probe slot; CB + per-session outcome recorded once per refresh operation, not once per waiter - Redis connection pool: handle nil receive when pool closed concurrently - FileStore: atomic temp-write + rename - errors_recovery health-check data race -> atomic Test-isolation / hardening: - reset helpers for Once-pinned global cache manager and transport pool - coverage: utils 70->93% (redirect URL security contract); fuzz targets for bearer parsers; concurrent ServeHTTP race tests for the shared request path Dead-code removal (verified orphaned, build+suite green): internal/providers (30 files, 0 importers), internal/compat, internal/features, input_validation. Verified: govulncheck, go mod tidy, yaegi-validate, cross-compile (darwin+ linux), golangci-lint (new-from-rev clean), 3x full race+shuffle green.
47 lines
1.2 KiB
Go
47 lines
1.2 KiB
Go
package traefikoidc
|
|
|
|
import "testing"
|
|
|
|
// FuzzParseBearerJOSEHeader verifies the attacker-controlled JWT header parser
|
|
// never panics on arbitrary input (no slice OOB, no unbounded alloc, no
|
|
// JSON-engine surprise) regardless of token contents.
|
|
func FuzzParseBearerJOSEHeader(f *testing.F) {
|
|
seeds := []string{
|
|
"",
|
|
"...",
|
|
"abc.def.ghi",
|
|
"eyJhbGciOiJSUzI1NiIsImtpZCI6ImtpZDEifQ.sig.sig", // alg=RS256 kid=kid1
|
|
"::",
|
|
"snapshot=",
|
|
"a,b.zzz",
|
|
}
|
|
for _, s := range seeds {
|
|
f.Add(s)
|
|
}
|
|
f.Fuzz(func(t *testing.T, token string) {
|
|
parseBearerJOSEHeader(token) // must not panic
|
|
})
|
|
}
|
|
|
|
// FuzzSanitizeBearerIdentifier verifies the identifier sanitizer never panics on
|
|
// arbitrary strings and always returns either a clean value or a *bearerError.
|
|
func FuzzSanitizeBearerIdentifier(f *testing.F) {
|
|
seeds := []string{
|
|
"",
|
|
"alice",
|
|
"user,group=admin",
|
|
"a\u202eb\u202c",
|
|
"\t \n",
|
|
"verylongidentifier-padding-padding-padding-padding",
|
|
}
|
|
for _, s := range seeds {
|
|
f.Add(s)
|
|
}
|
|
f.Fuzz(func(t *testing.T, raw string) {
|
|
id, berr := sanitizeBearerIdentifier(raw, 256)
|
|
if berr == nil && id == "" {
|
|
t.Fatalf("sanitize ok but empty identifier for %q", raw)
|
|
}
|
|
})
|
|
}
|