andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-06 22:32:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* Add DenyLists parsing

* Remove unneeded returned error

* Plug global denylist into Command

* app creation: apply denylist to backchannel logout URI

* Inject denylist to backchannel logout worker

* webhook config: validate against blocked URLs

* Add notificationsWebhook denylist target

* command: Add SMTP endpoint validation against blocklist

* command: Add SMS endpoint validation against blocklist

* Validate webhook endpoint against denylist on channel notification

* Remove unused tests

* handle deprecated denylists

* remove unintended denylist entry in deprecated list

* use single http client

* fix tests

* update comments

* fixes

* cleanup

* address comments

* fix merge

---------

Co-authored-by: Livio Spring <[email protected]>
This commit is contained in:
Marco A.
2026-06-15 15:36:14 +02:00
committed by GitHub
co-authored by Livio Spring
parent d184e976fc
commit 8e82ec1cb9
97 changed files with 1834 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/grpc/server/connect_middleware/execution_interceptor.go
+7 -8
View File
@@ -13,7 +13,6 @@ import (
"github.com/zitadel/zitadel/internal/api/authz"
http_utils "github.com/zitadel/zitadel/internal/api/http"
"github.com/zitadel/zitadel/internal/crypto"
"github.com/zitadel/zitadel/internal/denylist"
"github.com/zitadel/zitadel/internal/execution"
target_domain "github.com/zitadel/zitadel/internal/execution/target"
"github.com/zitadel/zitadel/internal/telemetry/tracing"
@@ -27,12 +26,12 @@ var headersToForward = map[string]bool{
strings.ToLower(http_utils.Origin): true,
}
func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) connect.UnaryInterceptorFunc {
func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) connect.UnaryInterceptorFunc {
return func(handler connect.UnaryFunc) connect.UnaryFunc {
return func(ctx context.Context, req connect.AnyRequest) (_ connect.AnyResponse, err error) {
requestTargets := execution.QueryExecutionTargetsForRequest(ctx, req.Spec().Procedure)
handledReq, err := executeTargetsForRequest(ctx, requestTargets, req.Spec().Procedure, req, alg, activeSigningKey, deniedIPList)
handledReq, err := executeTargetsForRequest(ctx, requestTargets, req.Spec().Procedure, req, alg, activeSigningKey, httpClient)
if err != nil {
return nil, err
}
@@ -43,12 +42,12 @@ func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution
}
responseTargets := execution.QueryExecutionTargetsForResponse(ctx, req.Spec().Procedure)
return executeTargetsForResponse(ctx, responseTargets, req.Spec().Procedure, handledReq, response, alg, activeSigningKey, deniedIPList)
return executeTargetsForResponse(ctx, responseTargets, req.Spec().Procedure, handledReq, response, alg, activeSigningKey, httpClient)
}
}
}
func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ connect.AnyRequest, err error) {
func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) (_ connect.AnyRequest, err error) {
ctx, span := tracing.NewSpan(ctx)
defer func() { span.EndWithError(err) }()
@@ -68,14 +67,14 @@ func executeTargetsForRequest(ctx context.Context, targets []target_domain.Targe
Headers: SetRequestHeaders(req.Header()),
}
_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, httpClient)
if err != nil {
return nil, err
}
return req, nil
}
func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, resp connect.AnyResponse, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ connect.AnyResponse, err error) {
func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, resp connect.AnyResponse, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) (_ connect.AnyResponse, err error) {
ctx, span := tracing.NewSpan(ctx)
defer func() { span.EndWithError(err) }()
@@ -96,7 +95,7 @@ func executeTargetsForResponse(ctx context.Context, targets []target_domain.Targ
Headers: SetRequestHeaders(req.Header()),
}
_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, httpClient)
if err != nil {
return nil, err
}
internal/api/grpc/server/connect_middleware/execution_interceptor_test.go
+4 -8
View File
@@ -75,9 +75,7 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
}
func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
require.NoError(t, err)
deniedIPs := []denylist.AddressChecker{deniedLocalhost}
deniedIPs := []denylist.AddressChecker{denylist.NewHostChecker("127.0.0.1")}
type target struct {
reqBody execution.ContextInfo
@@ -668,7 +666,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
tt.args.req,
nil,
tt.args.getActiveSigningWebKey,
tt.args.deniedIPs,
&http.Client{Transport: denylist.NewHTTPTransport(tt.args.deniedIPs)},
)
if tt.res.wantErr {
@@ -774,9 +772,7 @@ func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
}
func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
require.NoError(t, err)
deniedIPs := []denylist.AddressChecker{deniedLocalhost}
deniedIPs := []denylist.AddressChecker{denylist.NewHostChecker("127.0.0.1")}
type target struct {
reqBody execution.ContextInfo
sleep time.Duration
@@ -942,7 +938,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
tt.args.resp,
nil,
mockGetActiveSigningWebKey(),
tt.args.deniedIPs,
&http.Client{Transport: denylist.NewHTTPTransport(tt.args.deniedIPs)},
)
if tt.res.wantErr {
internal/api/grpc/server/middleware/execution_interceptor.go
+7 -8
View File
@@ -13,17 +13,16 @@ import (
"github.com/zitadel/zitadel/internal/api/authz"
"github.com/zitadel/zitadel/internal/api/grpc/server/connect_middleware"
"github.com/zitadel/zitadel/internal/crypto"
"github.com/zitadel/zitadel/internal/denylist"
"github.com/zitadel/zitadel/internal/execution"
target_domain "github.com/zitadel/zitadel/internal/execution/target"
"github.com/zitadel/zitadel/internal/telemetry/tracing"
)
func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) grpc.UnaryServerInterceptor {
func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) grpc.UnaryServerInterceptor {
return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
requestTargets := execution.QueryExecutionTargetsForRequest(ctx, info.FullMethod)
// call targets otherwise return req
handledReq, err := executeTargetsForRequest(ctx, requestTargets, info.FullMethod, req, alg, activeSigningKey, deniedIPList)
handledReq, err := executeTargetsForRequest(ctx, requestTargets, info.FullMethod, req, alg, activeSigningKey, httpClient)
if err != nil {
return nil, err
}
@@ -34,11 +33,11 @@ func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution
}
responseTargets := execution.QueryExecutionTargetsForResponse(ctx, info.FullMethod)
return executeTargetsForResponse(ctx, responseTargets, info.FullMethod, handledReq, response, alg, activeSigningKey, deniedIPList)
return executeTargetsForResponse(ctx, responseTargets, info.FullMethod, handledReq, response, alg, activeSigningKey, httpClient)
}
}
func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req any, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ interface{}, err error) {
func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req any, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) (_ interface{}, err error) {
ctx, span := tracing.NewSpan(ctx)
defer func() { span.EndWithError(err) }()
@@ -59,10 +58,10 @@ func executeTargetsForRequest(ctx context.Context, targets []target_domain.Targe
Headers: connect_middleware.SetRequestHeaders(md),
}
return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, httpClient)
}
func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req, resp interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ interface{}, err error) {
func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req, resp interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) (_ interface{}, err error) {
ctx, span := tracing.NewSpan(ctx)
defer func() { span.EndWithError(err) }()
@@ -84,7 +83,7 @@ func executeTargetsForResponse(ctx context.Context, targets []target_domain.Targ
Headers: connect_middleware.SetRequestHeaders(md),
}
return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, httpClient)
}
var _ execution.ContextInfo = &ContextInfoRequest{}
internal/api/grpc/server/middleware/execution_interceptor_test.go
+4 -8
View File
@@ -64,9 +64,7 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
}
func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
require.NoError(t, err)
deniedIPs := []denylist.AddressChecker{deniedLocalhost}
deniedIPs := []denylist.AddressChecker{denylist.NewHostChecker("127.0.0.1")}
type target struct {
reqBody execution.ContextInfo
@@ -656,7 +654,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
tt.args.req,
nil,
tt.args.getActiveSigningWebKey,
tt.args.deniedIPs,
&http.Client{Transport: denylist.NewHTTPTransport(tt.args.deniedIPs)},
)
if tt.res.wantErr {
@@ -762,9 +760,7 @@ func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
}
func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
require.NoError(t, err)
deniedIPs := []denylist.AddressChecker{deniedLocalhost}
deniedIPs := []denylist.AddressChecker{denylist.NewHostChecker("127.0.0.1")}
type target struct {
reqBody execution.ContextInfo
@@ -930,7 +926,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
tt.args.resp,
nil,
mockGetActiveSigningWebKey(),
tt.args.deniedIPs,
&http.Client{Transport: denylist.NewHTTPTransport(tt.args.deniedIPs)},
)
if tt.res.wantErr {
internal/api/grpc/server/server.go
+2 -3
View File
@@ -16,7 +16,6 @@ import (
grpc_api "github.com/zitadel/zitadel/internal/api/grpc"
"github.com/zitadel/zitadel/internal/api/grpc/server/middleware"
"github.com/zitadel/zitadel/internal/crypto"
"github.com/zitadel/zitadel/internal/denylist"
"github.com/zitadel/zitadel/internal/i18n"
"github.com/zitadel/zitadel/internal/logstore"
"github.com/zitadel/zitadel/internal/logstore/record"
@@ -69,7 +68,7 @@ func CreateServer(
accessSvc *logstore.Service[*record.AccessLog],
targetEncAlg crypto.EncryptionAlgorithm,
translator *i18n.Translator,
deniedIPList []denylist.AddressChecker,
httpClient *http.Client,
) *grpc.Server {
metricTypes := []metrics.MetricType{metrics.MetricTypeTotalCount, metrics.MetricTypeRequestCount, metrics.MetricTypeStatusCode}
serverOptions := []grpc.ServerOption{
@@ -87,7 +86,7 @@ func CreateServer(
middleware.AuthorizationInterceptor(verifier, systemAuthz, authConfig),
middleware.TranslationHandler(),
middleware.QuotaExhaustedInterceptor(accessSvc, system_pb.SystemService_ServiceDesc.ServiceName),
middleware.ExecutionHandler(targetEncAlg, queries.GetActiveSigningWebKey, deniedIPList),
middleware.ExecutionHandler(targetEncAlg, queries.GetActiveSigningWebKey, httpClient),
middleware.ValidationHandler(),
middleware.ServiceHandler(),
middleware.ActivityInterceptor(),