mirror of
https://github.com/iflytek/skillhub.git
synced 2026-09-12 23:01:05 +00:00
ace0cb2dd8
Blockers:
- Harden XML parsing against XXE (disallow DOCTYPE, external entities/DTDs,
enable FEATURE_SECURE_PROCESSING) and switch to UTF-8 byte decoding.
- Generalize AccessPolicy.evaluate from OAuthClaims to IdentityClaims; extract
IdentityAuthenticator so OAuth and CAS share allow/deny/pending evaluation.
CAS callback now goes through the policy instead of bypassing it with a
direct bindOrCreate call.
- Configure JDK HttpClient with connect/read timeouts (5s/10s) and disable
HTTP redirects to prevent ticket exfiltration via a malicious CAS server.
Major:
- Require HTTPS for skillhub.auth.cas.service-url in addition to server-url.
- Stop logging raw service tickets; log claims.subject() instead.
- Remove the dead authCasEnabled web flag — the backend AuthMethodCatalog is
the single source of truth for CAS visibility, matching how OAuth works.
- Wire SKILLHUB_AUTH_CAS_* env vars into compose.release.yml and add a fully
documented section in .env.release.example.
Minor:
- CasProtocolVersion enum replaces string comparisons in the validator.
- JSON multi-value array attributes are preserved as List<String> instead of
silently dropping all but the first element.
- AuthMethod.methodType union adds 'CAS_REDIRECT'.
- application.yml notes that service-url must equal
${SKILLHUB_PUBLIC_BASE_URL}/api/v1/auth/cas/callback.
Tests:
- CasTicketValidatorTest tightens URL matching to assert ticket/service/format
parameters and adds XXE + billion-laughs regression cases.
- IdentityAuthenticatorTest covers ALLOW / PENDING / DENY paths.
- AuthMethodCatalogTest exercises both cas.enabled=true and =false.
- isExternalRedirectMethod predicate extracted and unit-tested.
27 lines
1.4 KiB
Bash
27 lines
1.4 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
: "${SKILLHUB_WEB_API_BASE_URL:=}"
|
|
: "${SKILLHUB_PUBLIC_BASE_URL:=}"
|
|
: "${SKILLHUB_WEB_AUTH_DIRECT_ENABLED:=false}"
|
|
: "${SKILLHUB_WEB_AUTH_DIRECT_PROVIDER:=}"
|
|
|
|
# Session-bootstrap variables are defaulted here so envsubst writes
|
|
# `authSessionBootstrapEnabled: "false"` into runtime-config.js instead of leaving
|
|
# the literal `${...}` placeholder. They are intentionally NOT exposed in
|
|
# compose.release.yml or .env.release.example: the matching server-side switch
|
|
# does not exist yet, so surfacing the toggle would let the frontend hit
|
|
# /api/v1/auth/session/bootstrap and receive 403. See PR #280 discussion.
|
|
: "${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_ENABLED:=false}"
|
|
: "${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_PROVIDER:=}"
|
|
: "${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_AUTO:=false}"
|
|
|
|
# Generate runtime-config.js
|
|
envsubst '${SKILLHUB_WEB_API_BASE_URL} ${SKILLHUB_PUBLIC_BASE_URL} ${SKILLHUB_WEB_AUTH_DIRECT_ENABLED} ${SKILLHUB_WEB_AUTH_DIRECT_PROVIDER} ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_ENABLED} ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_PROVIDER} ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_AUTO}' \
|
|
< /usr/share/nginx/html/runtime-config.js.template \
|
|
> /usr/share/nginx/html/runtime-config.js
|
|
|
|
# Generate registry/skill.md with actual public URL
|
|
envsubst '${SKILLHUB_PUBLIC_BASE_URL}' \
|
|
< /usr/share/nginx/html/registry/skill.md.template \
|
|
> /usr/share/nginx/html/registry/skill.md
|