Upstream/harbor
1
0
Fork 0
mirror of https://github.com/goharbor/harbor.git synced 2025-01-13 19:21:56 +01:00
Code Issues Projects Releases Wiki Activity

Make v2auth more strict

Browse Source 
This commit enhances the v2auth middleware, such that any un-recognized
request sent to /v2/ will be blocked.

Signed-off-by: Daniel Jiang <jiangd@vmware.com>
This commit is contained in:
Daniel Jiang 2021-05-28 16:41:48 +08:00
parent 77b44a62e7
commit d3b8c613fd
2 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/server/middleware/v2auth/auth.go
View File

@ -17,14 +17,15 @@ package v2auth
import (
"context"
"fmt"
rbac_project "github.com/goharbor/harbor/src/common/rbac/project"
"github.com/goharbor/harbor/src/common/rbac/system"
"github.com/goharbor/harbor/src/lib/config"
"net/http"
"net/url"
"strings"
"sync"
rbac_project "github.com/goharbor/harbor/src/common/rbac/project"
"github.com/goharbor/harbor/src/common/rbac/system"
"github.com/goharbor/harbor/src/lib/config"
"github.com/goharbor/harbor/src/common/rbac"
"github.com/goharbor/harbor/src/common/security"
"github.com/goharbor/harbor/src/controller/project"
@ -49,7 +50,9 @@ func (rc *reqChecker) check(req *http.Request) (string, error) {
return "", fmt.Errorf("the security context got from request is nil")
}
al := accessList(req)
if len(al) == 0 {
return "", fmt.Errorf("un-recognized request: %s %s", req.Method, req.URL.Path)
}
for _, a := range al {
if a.target == login && !securityCtx.IsAuthenticated() {
return getChallenge(req, al), errors.New("unauthorized")

5
src/server/middleware/v2auth/auth_test.go
View File

@ -162,6 +162,7 @@ func TestMiddleware(t *testing.T) {
req4, _ := http.NewRequest(http.MethodPost, "/v2/project_1/ubuntu/blobs/uploads/mount=?mount=sha256:08e4a417ff4e3913d8723a05cc34055db01c2fd165b588e049c5bad16ce6094f&from=project_2/ubuntu", nil)
req5, _ := http.NewRequest(http.MethodPost, "/v2/project_1/ubuntu/blobs/uploads/mount=?mount=sha256:08e4a417ff4e3913d8723a05cc34055db01c2fd165b588e049c5bad16ce6094f&from=project_3/ubuntu", nil)
req6, _ := http.NewRequest(http.MethodPost, "/v2/project_1/ubuntu/blobs/uploads/mount=?mount=sha256:08e4a417ff4e3913d8723a05cc34055db01c2fd165b588e049c5bad16ce6094f&from=project_0/ubuntu", nil)
req7, _ := http.NewRequest(http.MethodPost, "/v2/uploads/mount=?mount=sha256:08e4a417ff4e3913d8723a05cc34055db01c2fd165b588e049c5bad16ce6094f&from=project_0/ubuntu", nil)
cases := []struct {
input *http.Request
@ -207,6 +208,10 @@ func TestMiddleware(t *testing.T) {
input: req6.WithContext(ctx5),
status: http.StatusUnauthorized,
},
{
input: req7.WithContext(ctx5),
status: http.StatusUnauthorized,
},
}
for _, c := range cases {
rec := httptest.NewRecorder()