From efe3e514b04e98c7804eda41d5d14a98c0685e2d Mon Sep 17 00:00:00 2001 From: William Mantly Date: Sat, 18 Jul 2026 22:08:11 -0400 Subject: [PATCH] chore(release): public-release readiness and security fixes for 1.1.16 Security: - Escape user-supplied values in LDAP filters and DNs (group_ldap.js, user_ldap.js) - Replace Math.random() token/UUID/OTP generation with crypto.randomUUID / crypto.randomInt - Refuse startup when oauth.jwtSecret is missing or placeholder Fixes: - Correct from-address template rendering in email.js Packaging: - Remove private flag and bump version to 1.1.16 Co-Authored-By: Claude --- CHANGELOG.md | 14 ++++++++++++++ nodejs/models/email.js | 2 +- nodejs/models/group_ldap.js | 33 ++++++++++++++++++++++++++++++--- nodejs/models/oauth_client.js | 3 ++- nodejs/models/oauth_code.js | 3 ++- nodejs/models/token.js | 5 +++-- nodejs/models/user_ldap.js | 22 +++++++++++++++++++--- nodejs/package.json | 3 +-- nodejs/routes/oauth.js | Bin 15986 -> 16168 bytes 9 files changed, 72 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a227e82..7930c76 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,20 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`. ## [Unreleased] +## [1.1.16] - 2026-07-18 + +### Security +- Hardened LDAP filter and DN construction against injection. All user-supplied values interpolated into group filters (`models/group_ldap.js`) and RDN values used when adding users/groups (`models/user_ldap.js`) are now escaped before being sent to the LDAP server. +- Replaced `Math.random()`-based token generation in `models/token.js`, `models/oauth_code.js`, and `models/oauth_client.js` with `crypto.randomUUID()` for session tokens, OAuth codes, access/refresh tokens, and client IDs. +- Replaced `Math.random()`-based OTP generation in `OtpToken.issue()` with `crypto.randomInt()`. +- `routes/oauth.js` now refuses to start if `oauth.jwtSecret` is missing or still set to the placeholder value, instead of falling back to a hardcoded public string. + +### Changed +- Public-release packaging: removed `"private": true` from `nodejs/package.json` and bumped version to `1.1.16`. + +### Fixed +- `models/email.js`: fixed a template bug where the rendered `from` address used `template.message` instead of `template.from`. + ## [1.1.15] - 2026-07-18 ### Changed diff --git a/nodejs/models/email.js b/nodejs/models/email.js index b131715..80bb7ee 100644 --- a/nodejs/models/email.js +++ b/nodejs/models/email.js @@ -58,7 +58,7 @@ Mail.sendTemplate = async function(to, template, context, from){ to, mustache.render(template.subject, context), mustache.render(template.message, context), - from || (template.from && mustache.render(template.message, context)) + from || (template.from && mustache.render(template.from, context)) ) }; diff --git a/nodejs/models/group_ldap.js b/nodejs/models/group_ldap.js index 43ada8a..4f939aa 100644 --- a/nodejs/models/group_ldap.js +++ b/nodejs/models/group_ldap.js @@ -4,6 +4,31 @@ const { Client, Attribute, Change } = require('ldapts'); const { LRUCache } = require('lru-cache'); const conf = require('@simpleworkjs/conf').ldap; +// Escape a value used inside an LDAP search filter (RFC 4515). +function escapeLDAPSearchValue(val) { + return String(val) + .replace(/\\/g, '\\5c') + .replace(/\*/g, '\\2a') + .replace(/\(/g, '\\28') + .replace(/\)/g, '\\29') + .replace(/\0/g, '\\00'); +} + +// Escape a value used in an LDAP DN (RFC 4514). Defensive: usernames/cns +// are normally alphanumeric, but this prevents metacharacter injection. +function escapeLDAPDNValue(val) { + return String(val) + .replace(/\\/g, '\\\\') + .replace(/,/g, '\\,') + .replace(/\+/g, '\\+') + .replace(/"/g, '\\"') + .replace(//g, '\\>') + .replace(/;/g, '\\;') + .replace(/=/g, '\\=') + .replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match); +} + function makeClient() { return new Client({ url: conf.url }); } @@ -19,7 +44,7 @@ async function withClient(fn) { } async function getGroups(client, member){ - let memberFilter = member ? `(member=${member})`: '' + let memberFilter = member ? `(member=${escapeLDAPSearchValue(member)})`: '' let groups = (await client.search(conf.groupBase, { scope: 'sub', @@ -35,7 +60,8 @@ async function getGroups(client, member){ } async function addGroup(client, data){ - await client.add(`cn=${data.name},${conf.groupBase}`, { + const safeName = escapeLDAPDNValue(data.name); + await client.add(`cn=${safeName},${conf.groupBase}`, { cn: data.name, member: data.owner, description: data.description, @@ -139,9 +165,10 @@ Group.get = async function(data){ } return withClient(async (client) => { + const safeName = escapeLDAPSearchValue(data.name); let group = (await client.search(conf.groupBase, { scope: 'sub', - filter: `(&(objectClass=groupOfNames)(cn=${data.name}))`, + filter: `(&(objectClass=groupOfNames)(cn=${safeName}))`, attributes: ['cn', 'description', 'member', 'owner', 'createTimestamp', 'modifyTimestamp'], })).searchEntries[0]; diff --git a/nodejs/models/oauth_client.js b/nodejs/models/oauth_client.js index cea7bce..14063d6 100644 --- a/nodejs/models/oauth_client.js +++ b/nodejs/models/oauth_client.js @@ -2,7 +2,8 @@ const Table = require('.'); const bcrypt = require('bcrypt'); -const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)}; +const crypto = require('crypto'); +const UUID = () => crypto.randomUUID(); const conf = require('@simpleworkjs/conf'); const defaultLifetime = (conf.oauth && conf.oauth.token_lifetime) || { diff --git a/nodejs/models/oauth_code.js b/nodejs/models/oauth_code.js index 7da5665..64739b9 100644 --- a/nodejs/models/oauth_code.js +++ b/nodejs/models/oauth_code.js @@ -1,7 +1,8 @@ 'use strict'; const Table = require('.'); -const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)}; +const crypto = require('crypto'); +const UUID = () => crypto.randomUUID(); // Shared base keyMap matching Token's schema so these behave as tokens const tokenKeyMap = { diff --git a/nodejs/models/token.js b/nodejs/models/token.js index b845783..a282104 100644 --- a/nodejs/models/token.js +++ b/nodejs/models/token.js @@ -1,7 +1,8 @@ 'use strict'; const Table = require('.'); -const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)}; +const crypto = require('crypto'); +const UUID = () => crypto.randomUUID(); class Token extends Table{ @@ -110,7 +111,7 @@ class OtpToken extends Token { for (const t of existing) { if (t.is_valid) await t.update({is_valid: false}); } - const code = String(Math.floor(100000 + Math.random() * 900000)); + const code = String(crypto.randomInt(100000, 1000000)); return this.create({uid, code, method, created_by: uid}); } diff --git a/nodejs/models/user_ldap.js b/nodejs/models/user_ldap.js index 50f3e30..26bb22c 100644 --- a/nodejs/models/user_ldap.js +++ b/nodejs/models/user_ldap.js @@ -45,6 +45,20 @@ function escapeLDAPSearchValue(val) { .replace(/\0/g, '\\00'); } +// Escape a value used in an LDAP DN (RFC 4514). +function escapeLDAPDNValue(val) { + return String(val) + .replace(/\\/g, '\\\\') + .replace(/,/g, '\\,') + .replace(/\+/g, '\\+') + .replace(/"/g, '\\"') + .replace(//g, '\\>') + .replace(/;/g, '\\;') + .replace(/=/g, '\\=') + .replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match); +} + // Compute the next available uid/gidNumber: the highest existing value below // conf.uidGidReservedFloor, plus one -- or conf.uidGidMin if there are no // such entries yet. Entries at/above the reserved floor (e.g. a bootstrap @@ -72,7 +86,8 @@ async function addPosixGroup(client, data){ data.gidNumber = nextPosixId(groups, 'gidNumber'); - await client.add(`cn=${data.cn},${conf.groupBase}`, { + const safeCn = escapeLDAPDNValue(data.cn); + await client.add(`cn=${safeCn},${conf.groupBase}`, { cn: data.cn, gidNumber: data.gidNumber, objectclass: [ 'posixGroup', 'top' ] @@ -94,6 +109,7 @@ async function addPosixAccount(client, data){ data.uidNumber = nextPosixId(people, 'uidNumber'); + const safeCn = escapeLDAPDNValue(data.cn); const entry = { cn: data.cn, sn: data.sn, @@ -143,7 +159,7 @@ async function addPosixAccount(client, data){ entry.manager = [].concat(data.manager); } - await client.add(`cn=${data.cn},${conf.userBase}`, entry); + await client.add(`cn=${safeCn},${conf.userBase}`, entry); return data @@ -799,7 +815,7 @@ User.addSSHkey = async function(data) { // memberUid (RFC 2307, posixGroup) is a bare username, not a DN, unlike // groupOfNames' `member` used by app_sso_* groups in group_ldap.js. function personalGroupDN(uid){ - return `cn=${uid},${conf.groupBase}`; + return `cn=${escapeLDAPDNValue(uid)},${conf.groupBase}`; } User.getPersonalGroupMembers = async function(uid) { diff --git a/nodejs/package.json b/nodejs/package.json index 3ea313e..beba69d 100755 --- a/nodejs/package.json +++ b/nodejs/package.json @@ -1,7 +1,6 @@ { "name": "t42-sso-manager", - "version": "1.1.15", - "private": true, + "version": "1.1.16", "author": [ { "name": "William Mantly", diff --git a/nodejs/routes/oauth.js b/nodejs/routes/oauth.js index 847538428a35964083e5e58ca52f8c3dbdb01f06..47630cd3688b368a7ea06cd14f1e6111c909376a 100644 GIT binary patch delta 223 zcmZvWPYQxS7{$R|p5nC{UFZeGWf!Oe45pvXM9s)IBNAC&r)AL1>H^sxh#+{I$NRzW z-G=k&QUzlc>Kf5})B6>bOdi94Z^`o-gf-s$C_%(1m_F(+BEQr QP_%6-;w(H~$Kakl0J0iSLjV8( delta 40 vcmZ2c_o-$>3X`-#O^t$jaz