mirrors/crowdsec
1
0
Fork 0
mirror of https://github.com/crowdsecurity/crowdsec.git synced 2025-05-10 20:05:55 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 13

Allowlists: fix range check in LAPI endpoint (#3538)

Browse source
This commit is contained in:
blotus 2025-03-25 14:30:18 +01:00 • committed by GitHub
parent 55aa1893d1
commit d64f196b3f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 40 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
pkg/apiclient/allowlists_service.go
View file

@ -4,6 +4,7 @@ import (
"context"
"fmt"
"net/http"
"net/url"
qs "github.com/google/go-querystring/query"
log "github.com/sirupsen/logrus"
@ -74,7 +75,8 @@ func (s *AllowlistsService) Get(ctx context.Context, name string, opts Allowlist
}
func (s *AllowlistsService) CheckIfAllowlisted(ctx context.Context, value string) (bool, *Response, error) {
u := s.client.URLPrefix + "/allowlists/check/" + value
escapedValue := url.PathEscape(value)
u := s.client.URLPrefix + "/allowlists/check/" + escapedValue
req, err := s.client.PrepareRequest(ctx, http.MethodHead, u, nil)
if err != nil {
@ -92,7 +94,8 @@ func (s *AllowlistsService) CheckIfAllowlisted(ctx context.Context, value string
}
func (s *AllowlistsService) CheckIfAllowlistedWithReason(ctx context.Context, value string) (*models.CheckAllowlistResponse, *Response, error) {
u := s.client.URLPrefix + "/allowlists/check/" + value
escapedValue := url.PathEscape(value)
u := s.client.URLPrefix + "/allowlists/check/" + escapedValue
req, err := s.client.PrepareRequest(ctx, http.MethodGet, u, nil)
if err != nil {

22
pkg/apiserver/allowlists_test.go
View file

@ -115,13 +115,35 @@ func TestCheckInAllowlist(t *testing.T) {
require.NoError(t, err)
require.False(t, resp.Allowlisted)
// GET request, should return 200 and status in body
w = lapi.RecordResponse(t, ctx, http.MethodGet, "/v1/allowlists/check/2.3.4.0%2F24", emptyBody, passwordAuthType)
require.Equal(t, http.StatusOK, w.Code)
resp = models.CheckAllowlistResponse{}
err = json.Unmarshal(w.Body.Bytes(), &resp)
require.NoError(t, err)
require.False(t, resp.Allowlisted)
// HEAD request, should return 200
w = lapi.RecordResponse(t, ctx, http.MethodHead, "/v1/allowlists/check/1.2.3.4", emptyBody, passwordAuthType)
require.Equal(t, http.StatusOK, w.Code)
// HEAD request, should return 200
w = lapi.RecordResponse(t, ctx, http.MethodHead, "/v1/allowlists/check/1.2.3.0%2F24", emptyBody, passwordAuthType)
require.Equal(t, http.StatusOK, w.Code)
// HEAD request, should return 204
w = lapi.RecordResponse(t, ctx, http.MethodHead, "/v1/allowlists/check/2.3.4.5", emptyBody, passwordAuthType)
require.Equal(t, http.StatusNoContent, w.Code)
// HEAD request, should return 204
w = lapi.RecordResponse(t, ctx, http.MethodHead, "/v1/allowlists/check/2.3.4.5%2F24", emptyBody, passwordAuthType)
require.Equal(t, http.StatusNoContent, w.Code)
}

2
pkg/apiserver/controllers/controller.go
View file

@ -98,6 +98,8 @@ func (c *Controller) NewV1() error {
c.Router.GET("/health", gin.WrapF(serveHealth()))
c.Router.Use(v1.PrometheusMiddleware())
c.Router.HandleMethodNotAllowed = true
c.Router.UnescapePathValues = true
c.Router.UseRawPath = true
c.Router.NoRoute(func(ctx *gin.Context) {
ctx.AbortWithStatus(http.StatusNotFound)
})

11
test/bats/cscli-allowlists.bats
View file

@ -135,6 +135,17 @@ teardown() {
refute_stderr
}
@test "cscli allolists: range check" {
rune -0 cscli allowlist create foo -d 'a foo'
rune -0 cscli allowlist add foo 192.168.0.0/16
rune -1 cscli decisions add -r 192.168.10.20/24
assert_stderr 'Error: 192.168.10.20/24 is allowlisted by item 192.168.0.0/16 from foo, use --bypass-allowlist to add the decision anyway'
refute_output
rune -0 cscli decisions add -r 192.168.10.20/24 --bypass-allowlist
assert_stderr --partial 'Decision successfully added'
refute_output
}
@test "cscli allowlists delete" {
rune -1 cscli allowlist delete
assert_stderr 'Error: accepts 1 arg(s), received 0'