Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 34 additions & 24 deletions gateway/mw_auth_or_wrapper.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@
"net/http"
"net/http/httptest"

"github.com/TykTechnologies/tyk/apidef"
"github.com/TykTechnologies/tyk/apidef/oas"
"github.com/TykTechnologies/tyk/coprocess"
)

// OpenAPI security scheme constants
Expand Down Expand Up @@ -301,29 +303,38 @@
a.authMiddlewares = append(a.authMiddlewares, openIDMw)
}

// Custom plugin middlewares
if spec.UseGoPluginAuth {
goPluginMw := &GoPluginMiddleware{BaseMiddleware: a.BaseMiddleware.Copy()}
goPluginMw.Spec = spec
goPluginMw.Gw = a.Gw
goPluginMw.Init()
a.authMiddlewares = append(a.authMiddlewares, goPluginMw)
}

if spec.EnableCoProcessAuth {
coProcessMw := &CoProcessMiddleware{BaseMiddleware: a.BaseMiddleware.Copy()}
coProcessMw.Spec = spec
coProcessMw.Gw = a.Gw
coProcessMw.Init()
a.authMiddlewares = append(a.authMiddlewares, coProcessMw)
}

if spec.CustomPluginAuthEnabled {
dynamicMw := &DynamicMiddleware{BaseMiddleware: a.BaseMiddleware.Copy()}
dynamicMw.Spec = spec
dynamicMw.Gw = a.Gw
dynamicMw.Init()
a.authMiddlewares = append(a.authMiddlewares, dynamicMw)
customPluginAuthEnabled := spec.CustomPluginAuthEnabled || spec.UseGoPluginAuth || spec.EnableCoProcessAuth
if customPluginAuthEnabled {
switch spec.CustomMiddleware.Driver {
case apidef.OttoDriver:
dynamicMw := &DynamicMiddleware{BaseMiddleware: a.BaseMiddleware.Copy()}

Check failure on line 310 in gateway/mw_auth_or_wrapper.go

View workflow job for this annotation

GitHub Actions / lint

QF1008: could remove embedded field "BaseMiddleware" from selector (staticcheck)
dynamicMw.Spec = spec
dynamicMw.Gw = a.Gw
dynamicMw.MiddlewareClassName = spec.CustomMiddleware.AuthCheck.Name
dynamicMw.Auth = true
dynamicMw.Init()
a.authMiddlewares = append(a.authMiddlewares, dynamicMw)
case apidef.GoPluginDriver:
goPluginMw := &GoPluginMiddleware{BaseMiddleware: a.BaseMiddleware.Copy()}

Check failure on line 318 in gateway/mw_auth_or_wrapper.go

View workflow job for this annotation

GitHub Actions / lint

QF1008: could remove embedded field "BaseMiddleware" from selector (staticcheck)
goPluginMw.Spec = spec
goPluginMw.Gw = a.Gw
goPluginMw.Path = spec.CustomMiddleware.AuthCheck.Path
goPluginMw.SymbolName = spec.CustomMiddleware.AuthCheck.Name
goPluginMw.APILevel = true
goPluginMw.Init()
goPluginMw.loadPlugin()

Check failure on line 325 in gateway/mw_auth_or_wrapper.go

View check run for this annotation

probelabs / Visor: security

security Issue

The Go plugin path is taken directly from the API definition (`spec.CustomMiddleware.AuthCheck.Path`) and used to load a shared object (`.so`) file without proper sanitization. This introduces a path traversal vulnerability.
Raw output
An attacker with permissions to create or modify an API definition could specify a plugin path like `../../../../path/to/malicious.so`. If the attacker can also upload a malicious shared object file to the server, this could lead to remote code execution. The path should be sanitized to ensure it resolves to a file within a designated, secure plugin directory. The application should not load plugins from arbitrary filesystem locations based on user-supplied configuration.
a.authMiddlewares = append(a.authMiddlewares, goPluginMw)
default:
coProcessMw := &CoProcessMiddleware{BaseMiddleware: a.BaseMiddleware.Copy()}

Check failure on line 328 in gateway/mw_auth_or_wrapper.go

View workflow job for this annotation

GitHub Actions / lint

QF1008: could remove embedded field "BaseMiddleware" from selector (staticcheck)
coProcessMw.Spec = spec
coProcessMw.Gw = a.Gw
coProcessMw.HookType = coprocess.HookType_CustomKeyCheck
coProcessMw.HookName = spec.CustomMiddleware.AuthCheck.Name
coProcessMw.MiddlewareDriver = spec.CustomMiddleware.Driver
coProcessMw.RawBodyOnly = spec.CustomMiddleware.AuthCheck.RawBodyOnly
coProcessMw.Init()
a.authMiddlewares = append(a.authMiddlewares, coProcessMw)
}
}

if spec.UseStandardAuth || len(a.authMiddlewares) == 0 {
Expand All @@ -333,5 +344,4 @@
authKeyMw.Init()
a.authMiddlewares = append(a.authMiddlewares, authKeyMw)
}

}
6 changes: 6 additions & 0 deletions gateway/mw_auth_or_wrapper_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -4358,6 +4358,9 @@ func TestAuthORWrapper_getMiddlewareForScheme(t *testing.T) {
setupSpec: func(spec *APISpec) {
spec.UseGoPluginAuth = true
spec.IsOAS = true
spec.CustomMiddleware = apidef.MiddlewareSection{
Driver: apidef.GoPluginDriver,
}

tykExt := &oas.XTykAPIGateway{
Server: oas.Server{
Expand Down Expand Up @@ -4402,6 +4405,9 @@ func TestAuthORWrapper_getMiddlewareForScheme(t *testing.T) {
setupSpec: func(spec *APISpec) {
spec.CustomPluginAuthEnabled = true
spec.IsOAS = true
spec.CustomMiddleware = apidef.MiddlewareSection{
Driver: apidef.OttoDriver,
}

tykExt := &oas.XTykAPIGateway{
Server: oas.Server{
Expand Down
Loading