From 10c5a29c478f030565cc63f423a5c427ca57b8b3 Mon Sep 17 00:00:00 2001 From: Kyle Spearrin Date: Fri, 5 Nov 2021 14:49:45 -0400 Subject: [PATCH] Prevent XSS possibility from SSO SAML Service URLs (#1691) * validate sso service urls for HTML meta chars * also check for double quotes --- .../OrganizationSsoRequestModel.cs | 28 +++++++++++++ src/Core/Resources/SharedResources.en.resx | 39 ++++++++++++------- 2 files changed, 52 insertions(+), 15 deletions(-) diff --git a/src/Core/Models/Api/Request/Organizations/OrganizationSsoRequestModel.cs b/src/Core/Models/Api/Request/Organizations/OrganizationSsoRequestModel.cs index e08b19004e..66319f47bf 100644 --- a/src/Core/Models/Api/Request/Organizations/OrganizationSsoRequestModel.cs +++ b/src/Core/Models/Api/Request/Organizations/OrganizationSsoRequestModel.cs @@ -159,6 +159,25 @@ namespace Bit.Core.Models.Api yield return new ValidationResult(i18nService.GetLocalizedHtmlString("IdpSingleSignOnServiceUrlValidationError"), new[] { nameof(IdpSingleSignOnServiceUrl) }); } + + if (ContainsHtmlMetaCharacters(IdpSingleSignOnServiceUrl)) + { + yield return new ValidationResult(i18nService.GetLocalizedHtmlString("IdpSingleSignOnServiceUrlInvalid"), + new[] { nameof(IdpSingleSignOnServiceUrl) }); + } + + if (ContainsHtmlMetaCharacters(IdpArtifactResolutionServiceUrl)) + { + yield return new ValidationResult(i18nService.GetLocalizedHtmlString("IdpArtifactResolutionServiceUrlInvalid"), + new[] { nameof(IdpArtifactResolutionServiceUrl) }); + } + + if (ContainsHtmlMetaCharacters(IdpSingleLogoutServiceUrl)) + { + yield return new ValidationResult(i18nService.GetLocalizedHtmlString("IdpSingleLogoutServiceUrlInvalid"), + new[] { nameof(IdpSingleLogoutServiceUrl) }); + } + if (!string.IsNullOrWhiteSpace(IdpX509PublicCert)) { // Validate the certificate is in a valid format @@ -240,5 +259,14 @@ namespace Bit.Core.Models.Api string.Empty, RegexOptions.Multiline | RegexOptions.IgnoreCase | RegexOptions.CultureInvariant); } + + private bool ContainsHtmlMetaCharacters(string url) + { + if (string.IsNullOrWhiteSpace(url)) + { + return false; + } + return Regex.IsMatch(url, "[<>\"]"); + } } } diff --git a/src/Core/Resources/SharedResources.en.resx b/src/Core/Resources/SharedResources.en.resx index 55e8525454..57f09f5a93 100644 --- a/src/Core/Resources/SharedResources.en.resx +++ b/src/Core/Resources/SharedResources.en.resx @@ -442,19 +442,19 @@ Request ID - + Redirecting - + You are now being returned to the application. Once complete, you may close this tab. - + If IdP Wants Authn Requests Signed - + Always - + Never @@ -466,33 +466,33 @@ The IdP public certificate provided does not appear to be a valid certificate, please ensure this is a valid, Base64 encoded PEM or CER format public certificate valid for signing: {0} - + Copy the OIDC callback path to your clipboard - + Copy the OIDC signed out callback path to your clipboard - + Copy the SP Entity Id to your clipboard - + Copy the SAML 2.0 Metadata URL to your clipboard - + View the SAML 2.0 Metadata (opens in a new window) - + Copy the Assertion Consumer Service (ACS) URL to your clipboard - + Redirect A SAML binding type, Redirect - + HTTP POST A SAML binding type, HTTP POST - + Artifact A SAML binding type, Artifact @@ -667,4 +667,13 @@ Require new users to be enrolled automatically - + + Artifact resolution service URL contains illegal characters. + + + Single log out service URL contains illegal characters. + + + Single sign on service URL contains illegal characters. + + \ No newline at end of file