Skip to content

Commit 89346e1

Browse files
JoshMcCulloughJoshMcCullough
authored
fix extraction of claims in nested config block (TeslaGov#91)
1 parent 08edb04 commit 89346e1

File tree

6 files changed

+102
-22
lines changed

6 files changed

+102
-22
lines changed

‎config

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
ngx_module_type=HTTP
22
ngx_addon_name=ngx_http_auth_jwt_module
33
ngx_module_name=$ngx_addon_name
4-
ngx_module_srcs="${ngx_addon_dir}/src/ngx_http_auth_jwt_binary_converters.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_header_processing.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_string.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_module.c"
4+
ngx_module_srcs="${ngx_addon_dir}/src/arrays.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_binary_converters.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_header_processing.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_string.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_module.c"
55
ngx_module_libs="-ljansson -ljwt -lm"
66

77
. auto/module

‎src/arrays.c

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#include "arrays.h"
2+
#include <ngx_core.h>
3+
4+
void merge_array(ngx_pool_t *pool, ngx_array_t **dest, const ngx_array_t *src, size_t size)
5+
{
6+
// only merge if dest is non-null and src is null
7+
if (src != NULL && *dest == NULL)
8+
{
9+
*dest = ngx_array_create(pool, src->nelts, size);
10+
11+
ngx_memcpy((*dest)->elts, src->elts, src->nelts * size);
12+
(*dest)->nelts = src->nelts;
13+
}
14+
}

‎src/arrays.h

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#ifndef _ARRAYS_H
2+
#define _ARRAYS_H
3+
#include <ngx_core.h>
4+
5+
void merge_array(ngx_pool_t *pool, ngx_array_t **dest, const ngx_array_t *src, size_t size);
6+
7+
#endif

‎src/ngx_http_auth_jwt_module.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414

1515
#include <jansson.h>
1616

17+
#include "arrays.h"
1718
#include "ngx_http_auth_jwt_header_processing.h"
1819
#include "ngx_http_auth_jwt_binary_converters.h"
1920
#include "ngx_http_auth_jwt_string.h"
@@ -212,8 +213,8 @@ static char *merge_conf(ngx_conf_t *cf, void *parent, void *child)
212213
ngx_conf_merge_str_value(conf->algorithm, prev->algorithm, "HS256");
213214
ngx_conf_merge_str_value(conf->keyfile_path, prev->keyfile_path, "");
214215
ngx_conf_merge_off_value(conf->validate_sub, prev->validate_sub, 0);
215-
ngx_conf_merge_ptr_value(conf->extract_request_claims, prev->extract_request_claims, NULL);
216-
ngx_conf_merge_ptr_value(conf->extract_request_claims, prev->extract_response_claims, NULL);
216+
merge_array(cf->pool, &conf->extract_request_claims, prev->extract_request_claims, sizeof(ngx_str_t));
217+
merge_array(cf->pool, &conf->extract_response_claims, prev->extract_response_claims, sizeof(ngx_str_t));
217218

218219
if (conf->enabled == NGX_CONF_UNSET)
219220
{

‎test/etc/nginx/conf.d/test.conf

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ BwIDAQAB
172172
auth_jwt_location HEADER=Authorization;
173173
auth_jwt_extract_request_claims firstName lastName;
174174

175-
add_header "Test" "$http_jwt_firstname $http_jwt_lastname";
175+
add_header "Test" "firstName=$http_jwt_firstname; lastName=$http_jwt_lastname";
176176

177177
alias /usr/share/nginx/html/;
178178
try_files index.html =404;
@@ -185,12 +185,26 @@ BwIDAQAB
185185
auth_jwt_extract_request_claims firstName;
186186
auth_jwt_extract_request_claims lastName;
187187

188-
add_header "Test" "$http_jwt_firstname $http_jwt_lastname";
188+
add_header "Test" "firstName=$http_jwt_firstname; lastName=$http_jwt_lastname";
189189

190190
alias /usr/share/nginx/html/;
191191
try_files index.html =404;
192192
}
193193

194+
___location /secure/extract-claim/request/nested {
195+
___location /secure/extract-claim/request/nested {
196+
auth_jwt_enabled on;
197+
auth_jwt_redirect off;
198+
auth_jwt_location HEADER=Authorization;
199+
auth_jwt_extract_request_claims username;
200+
201+
add_header "Test" "username=$http_jwt_username";
202+
203+
alias /usr/share/nginx/html/;
204+
try_files index.html =404;
205+
}
206+
}
207+
194208
___location /secure/extract-claim/response/sub {
195209
auth_jwt_enabled on;
196210
auth_jwt_redirect off;
@@ -209,7 +223,7 @@ BwIDAQAB
209223
auth_jwt_location HEADER=Authorization;
210224
auth_jwt_extract_response_claims firstName lastName;
211225

212-
add_header "Test" "$sent_http_jwt_firstname $sent_http_jwt_lastname";
226+
add_header "Test" "firstName=$sent_http_jwt_firstname; lastName=$sent_http_jwt_lastname";
213227

214228
alias /usr/share/nginx/html/;
215229
try_files index.html =404;
@@ -222,10 +236,24 @@ BwIDAQAB
222236
auth_jwt_extract_response_claims firstName;
223237
auth_jwt_extract_response_claims lastName;
224238

225-
add_header "Test" "$sent_http_jwt_firstname $sent_http_jwt_lastname";
239+
add_header "Test" "firstName=$sent_http_jwt_firstname; lastName=$sent_http_jwt_lastname";
226240

227241
alias /usr/share/nginx/html/;
228242
try_files index.html =404;
229243
}
244+
245+
___location /secure/extract-claim/response/nested {
246+
___location /secure/extract-claim/response/nested {
247+
auth_jwt_enabled on;
248+
auth_jwt_redirect off;
249+
auth_jwt_location HEADER=Authorization;
250+
auth_jwt_extract_response_claims username;
251+
252+
add_header "Test" "username=$sent_http_jwt_username";
253+
254+
alias /usr/share/nginx/html/;
255+
try_files index.html =404;
256+
}
257+
}
230258
}
231259

‎test/test.sh

Lines changed: 45 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -56,25 +56,25 @@ run_test () {
5656
printf "${RED}${name} -- unexpected exit code from cURL\n\tcURL Exit Code: ${exitCode}";
5757
NUM_FAILED=$((${NUM_FAILED} + 1));
5858
else
59-
OKAY=1
59+
local okay=1
6060

6161
if [ "${expectedCode}" != "" ]; then
6262
local responseCode=$(echo "${response}" | grep -Eo 'HTTP/1.1 ([0-9]{3})' | awk '{print $2}')
6363

6464
if [ "${expectedCode}" != "${responseCode}" ]; then
6565
printf "${RED}${name} -- unexpected status code\n\tExpected: ${expectedCode}\n\tActual: ${responseCode}\n\tPath: ${path}"
6666
NUM_FAILED=$((${NUM_FAILED} + 1))
67-
OKAY=0
67+
okay=0
6868
fi
6969
fi
70-
71-
if [ "${OKAY}" == "1" ] && [ "${expectedResponseRegex}" != "" ] && echo "${response}" | grep -Eq "${expectedResponseRegex}"; then
70+
71+
if [ "${okay}" == '1' ] && [ "${expectedResponseRegex}" != "" ] && ! [[ "${response}" =~ "${expectedResponseRegex}" ]]; then
7272
printf "${RED}${name} -- regex not found in response\n\tPath: ${path}\n\tRegEx: ${expectedResponseRegex}"
7373
NUM_FAILED=$((${NUM_FAILED} + 1))
74-
OKAY=0
74+
okay=0
7575
fi
7676

77-
if [ "${OKAY}" == "1" ]; then
77+
if [ "${okay}" == '1' ]; then
7878
printf "${GREEN}${name}";
7979
fi
8080
fi
@@ -197,34 +197,64 @@ main() {
197197
-c '200' \
198198
-x '--header "Auth-Token: Bearer ${JWT_HS256_VALID}"'
199199

200-
run_test -n 'extracts single claim to request header' \
200+
run_test -n 'extracts single claim to request variable' \
201201
-p '/secure/extract-claim/request/sub' \
202-
-r '^Test: sub=some-long-uuid$' \
202+
-r '< Test: sub=some-long-uuid' \
203203
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
204204

205-
run_test -n 'extracts multiple claims (single directive) to request header' \
205+
run_test -n 'extracts multiple claims (single directive) to request variable' \
206206
-p '/secure/extract-claim/request/name-1' \
207-
-r '^Test: hello world$' \
207+
-r '< Test: firstName=hello; lastName=world' \
208208
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
209209

210-
run_test -n 'extracts multiple claims (multiple directives) to request header' \
210+
run_test -n 'extracts multiple claims (multiple directives) to request variable' \
211211
-p '/secure/extract-claim/request/name-2' \
212-
-r '^Test: hello world$' \
212+
-r '< Test: firstName=hello; lastName=world' \
213+
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
214+
215+
run_test -n 'extracts nested claim to request variable' \
216+
-p '/secure/extract-claim/request/nested' \
217+
-r '< Test: username=hello.world' \
218+
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
219+
220+
run_test -n 'extracts single claim to response variable' \
221+
-p '/secure/extract-claim/response/sub' \
222+
-r '< Test: sub=some-long-uuid' \
223+
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
224+
225+
run_test -n 'extracts multiple claims (single directive) to response variable' \
226+
-p '/secure/extract-claim/response/name-1' \
227+
-r '< Test: firstName=hello; lastName=world' \
228+
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
229+
230+
run_test -n 'extracts multiple claims (multiple directives) to response variable' \
231+
-p '/secure/extract-claim/response/name-2' \
232+
-r '< Test: firstName=hello; lastName=world' \
233+
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
234+
235+
run_test -n 'extracts nested claim to response variable' \
236+
-p '/secure/extract-claim/response/nested' \
237+
-r '< Test: username=hello.world' \
213238
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
214239

215240
run_test -n 'extracts single claim to response header' \
216241
-p '/secure/extract-claim/response/sub' \
217-
-r '^Test: sub=some-long-uuid$' \
242+
-r '< JWT-sub: some-long-uuid' \
218243
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
219244

220245
run_test -n 'extracts multiple claims (single directive) to response header' \
221246
-p '/secure/extract-claim/response/name-1' \
222-
-r '^Test: hello world$' \
247+
-r '< JWT-firstName: hello' \
223248
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
224249

225250
run_test -n 'extracts multiple claims (multiple directives) to response header' \
226251
-p '/secure/extract-claim/response/name-2' \
227-
-r '^Test: hello world$' \
252+
-r '< JWT-firstName: hello' \
253+
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
254+
255+
run_test -n 'extracts nested claim to response header' \
256+
-p '/secure/extract-claim/response/nested' \
257+
-r '< JWT-username: hello.world' \
228258
-x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
229259

230260
if [[ "${NUM_FAILED}" = '0' ]]; then

0 commit comments

Comments
 (0)