theta42/sso-manager-node
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(release): public-release readiness and security fixes for 1.1.16

Browse Source 
Security:
- Escape user-supplied values in LDAP filters and DNs (group_ldap.js, user_ldap.js)
- Replace Math.random() token/UUID/OTP generation with crypto.randomUUID / crypto.randomInt
- Refuse startup when oauth.jwtSecret is missing or placeholder

Fixes:
- Correct from-address template rendering in email.js

Packaging:
- Remove private flag and bump version to 1.1.16

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-07-18 22:08:11 -04:00
parent 37f2ece172
commit efe3e514b0
9 changed files with 72 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+14
View File
@@ -6,6 +6,20 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
## [Unreleased]
## [1.1.16] - 2026-07-18
### Security
- Hardened LDAP filter and DN construction against injection. All user-supplied values interpolated into group filters (`models/group_ldap.js`) and RDN values used when adding users/groups (`models/user_ldap.js`) are now escaped before being sent to the LDAP server.
- Replaced `Math.random()`-based token generation in `models/token.js`, `models/oauth_code.js`, and `models/oauth_client.js` with `crypto.randomUUID()` for session tokens, OAuth codes, access/refresh tokens, and client IDs.
- Replaced `Math.random()`-based OTP generation in `OtpToken.issue()` with `crypto.randomInt()`.
- `routes/oauth.js` now refuses to start if `oauth.jwtSecret` is missing or still set to the placeholder value, instead of falling back to a hardcoded public string.
### Changed
- Public-release packaging: removed `"private": true` from `nodejs/package.json` and bumped version to `1.1.16`.
### Fixed
- `models/email.js`: fixed a template bug where the rendered `from` address used `template.message` instead of `template.from`.
## [1.1.15] - 2026-07-18
### Changed
nodejs/models/email.js
+1 -1
View File
@@ -58,7 +58,7 @@ Mail.sendTemplate = async function(to, template, context, from){
to,
mustache.render(template.subject, context),
mustache.render(template.message, context),
from || (template.from && mustache.render(template.message, context))
from || (template.from && mustache.render(template.from, context))
)
};
nodejs/models/group_ldap.js
+30 -3
View File
@@ -4,6 +4,31 @@ const { Client, Attribute, Change } = require('ldapts');
const { LRUCache } = require('lru-cache');
const conf = require('@simpleworkjs/conf').ldap;
// Escape a value used inside an LDAP search filter (RFC 4515).
function escapeLDAPSearchValue(val) {
return String(val)
.replace(/\\/g, '\\5c')
.replace(/\*/g, '\\2a')
.replace(/\(/g, '\\28')
.replace(/\)/g, '\\29')
.replace(/\0/g, '\\00');
}
// Escape a value used in an LDAP DN (RFC 4514). Defensive: usernames/cns
// are normally alphanumeric, but this prevents metacharacter injection.
function escapeLDAPDNValue(val) {
return String(val)
.replace(/\\/g, '\\\\')
.replace(/,/g, '\\,')
.replace(/\+/g, '\\+')
.replace(/"/g, '\\"')
.replace(/</g, '\\<')
.replace(/>/g, '\\>')
.replace(/;/g, '\\;')
.replace(/=/g, '\\=')
.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
}
function makeClient() {
return new Client({ url: conf.url });
}
@@ -19,7 +44,7 @@ async function withClient(fn) {
}
async function getGroups(client, member){
let memberFilter = member ? `(member=${member})`: ''
let memberFilter = member ? `(member=${escapeLDAPSearchValue(member)})`: ''
let groups = (await client.search(conf.groupBase, {
scope: 'sub',
@@ -35,7 +60,8 @@ async function getGroups(client, member){
}
async function addGroup(client, data){
await client.add(`cn=${data.name},${conf.groupBase}`, {
const safeName = escapeLDAPDNValue(data.name);
await client.add(`cn=${safeName},${conf.groupBase}`, {
cn: data.name,
member: data.owner,
description: data.description,
@@ -139,9 +165,10 @@ Group.get = async function(data){
}
return withClient(async (client) => {
const safeName = escapeLDAPSearchValue(data.name);
let group = (await client.search(conf.groupBase, {
scope: 'sub',
filter: `(&(objectClass=groupOfNames)(cn=${data.name}))`,
filter: `(&(objectClass=groupOfNames)(cn=${safeName}))`,
attributes: ['cn', 'description', 'member', 'owner', 'createTimestamp', 'modifyTimestamp'],
})).searchEntries[0];
nodejs/models/oauth_client.js
+2 -1
View File
@@ -2,7 +2,8 @@
const Table = require('.');
const bcrypt = require('bcrypt');
const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
const crypto = require('crypto');
const UUID = () => crypto.randomUUID();
const conf = require('@simpleworkjs/conf');
const defaultLifetime = (conf.oauth && conf.oauth.token_lifetime) || {
nodejs/models/oauth_code.js
+2 -1
View File
@@ -1,7 +1,8 @@
'use strict';
const Table = require('.');
const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
const crypto = require('crypto');
const UUID = () => crypto.randomUUID();
// Shared base keyMap matching Token's schema so these behave as tokens
const tokenKeyMap = {
nodejs/models/token.js
+3 -2
View File
@@ -1,7 +1,8 @@
'use strict';
const Table = require('.');
const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
const crypto = require('crypto');
const UUID = () => crypto.randomUUID();
class Token extends Table{
@@ -110,7 +111,7 @@ class OtpToken extends Token {
for (const t of existing) {
if (t.is_valid) await t.update({is_valid: false});
}
const code = String(Math.floor(100000 + Math.random() * 900000));
const code = String(crypto.randomInt(100000, 1000000));
return this.create({uid, code, method, created_by: uid});
}
nodejs/models/user_ldap.js
+19 -3
View File
@@ -45,6 +45,20 @@ function escapeLDAPSearchValue(val) {
.replace(/\0/g, '\\00');
}
// Escape a value used in an LDAP DN (RFC 4514).
function escapeLDAPDNValue(val) {
return String(val)
.replace(/\\/g, '\\\\')
.replace(/,/g, '\\,')
.replace(/\+/g, '\\+')
.replace(/"/g, '\\"')
.replace(/</g, '\\<')
.replace(/>/g, '\\>')
.replace(/;/g, '\\;')
.replace(/=/g, '\\=')
.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
}
// Compute the next available uid/gidNumber: the highest existing value below
// conf.uidGidReservedFloor, plus one -- or conf.uidGidMin if there are no
// such entries yet. Entries at/above the reserved floor (e.g. a bootstrap
@@ -72,7 +86,8 @@ async function addPosixGroup(client, data){
data.gidNumber = nextPosixId(groups, 'gidNumber');
await client.add(`cn=${data.cn},${conf.groupBase}`, {
const safeCn = escapeLDAPDNValue(data.cn);
await client.add(`cn=${safeCn},${conf.groupBase}`, {
cn: data.cn,
gidNumber: data.gidNumber,
objectclass: [ 'posixGroup', 'top' ]
@@ -94,6 +109,7 @@ async function addPosixAccount(client, data){
data.uidNumber = nextPosixId(people, 'uidNumber');
const safeCn = escapeLDAPDNValue(data.cn);
const entry = {
cn: data.cn,
sn: data.sn,
@@ -143,7 +159,7 @@ async function addPosixAccount(client, data){
entry.manager = [].concat(data.manager);
}
await client.add(`cn=${data.cn},${conf.userBase}`, entry);
await client.add(`cn=${safeCn},${conf.userBase}`, entry);
return data
@@ -799,7 +815,7 @@ User.addSSHkey = async function(data) {
// memberUid (RFC 2307, posixGroup) is a bare username, not a DN, unlike
// groupOfNames' `member` used by app_sso_* groups in group_ldap.js.
function personalGroupDN(uid){
return `cn=${uid},${conf.groupBase}`;
return `cn=${escapeLDAPDNValue(uid)},${conf.groupBase}`;
}
User.getPersonalGroupMembers = async function(uid) {
nodejs/package.json
+1 -2
View File
@@ -1,7 +1,6 @@
{
"name": "t42-sso-manager",
"version": "1.1.15",
"private": true,
"version": "1.1.16",
"author": [
{
"name": "William Mantly",
nodejs/routes/oauth.js
BIN
View File
Binary file not shown.