Skip to content

Commit f079d8d

Browse files
geroplgeropl
authored
[server, ws-proxy] Test cookie filter against real name generator (#19770)
* [server, ws-proxy] Extract CookieNameFromDomain into server/go, so installer (for config generation) and ws-proxy (for tests) can both depend on it * review comment
1 parent 504189b commit f079d8d

File tree

11 files changed

+67
-29
lines changed

11 files changed

+67
-29
lines changed

‎components/server/go/BUILD.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
packages:
2+
- name: lib
3+
type: go
4+
srcs:
5+
- "**/*.go"
6+
- "go.mod"
7+
- "go.sum"
8+
env:
9+
- CGO_ENABLED=0
10+
- GOOS=linux
11+
config:
12+
packaging: library

‎components/server/go/go.mod

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
module github.com/gitpod-io/gitpod/server/go
2+
3+
go 1.22.2

‎components/server/go/go.sum

Whitespace-only changes.

‎components/server/go/pkg/lib/cookie.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
// Copyright (c) 2024 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License.AGPL.txt in the project root for license information.
4+
5+
package lib
6+
7+
import "regexp"
8+
9+
func CookieNameFromDomain(domain string) string {
10+
// replace all non-word characters with underscores
11+
derived := regexp.MustCompile(`[\W_]+`).ReplaceAllString(domain, "_")
12+
return "_" + derived + "_jwt2_"
13+
}

‎components/ws-proxy/BUILD.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ packages:
1414
- components/registry-facade-api/go:lib
1515
- components/supervisor-api/go:lib
1616
- components/ws-manager-api/go:lib
17+
- components/server/go:lib
1718
env:
1819
- CGO_ENABLED=0
1920
- GOOS=linux
@@ -52,6 +53,7 @@ packages:
5253
- components/registry-facade-api/go:lib
5354
- components/supervisor-api/go:lib
5455
- components/ws-manager-api/go:lib
56+
- components/server/go:lib
5557
env:
5658
- CGO_ENABLED=0
5759
- GOOS=linux

‎components/ws-proxy/go.mod

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
module github.com/gitpod-io/gitpod/ws-proxy
22

3-
go 1.22
3+
go 1.22.2
44

55
require (
66
github.com/bombsimon/logrusr/v2 v2.0.1
77
github.com/gitpod-io/gitpod/common-go v0.0.0-00010101000000-000000000000
88
github.com/gitpod-io/gitpod/gitpod-protocol v0.0.0-00010101000000-000000000000
9+
github.com/gitpod-io/gitpod/server/go v0.0.0-00010101000000-000000000000
910
github.com/gitpod-io/gitpod/supervisor/api v0.0.0-00010101000000-000000000000
1011
github.com/gitpod-io/gitpod/ws-manager/api v0.0.0-00010101000000-000000000000
1112
github.com/gitpod-io/golang-crypto v0.0.0-20231122075959-de838e9cb174
@@ -118,6 +119,8 @@ replace github.com/gitpod-io/gitpod/supervisor/api => ../supervisor-api/go // le
118119

119120
replace github.com/gitpod-io/gitpod/ws-manager/api => ../ws-manager-api/go // leeway
120121

122+
replace github.com/gitpod-io/gitpod/server/go => ../server/go // leeway
123+
121124
replace k8s.io/api => k8s.io/api v0.29.3 // leeway indirect from components/common-go:lib
122125

123126
replace k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.29.3 // leeway indirect from components/common-go:lib

‎components/ws-proxy/pkg/proxy/routes_test.go

Lines changed: 20 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727

2828
"github.com/gitpod-io/gitpod/common-go/log"
2929
"github.com/gitpod-io/gitpod/common-go/util"
30+
server_lib "github.com/gitpod-io/gitpod/server/go/pkg/lib"
3031
"github.com/gitpod-io/gitpod/ws-manager/api"
3132
"github.com/gitpod-io/gitpod/ws-proxy/pkg/common"
3233
"github.com/gitpod-io/gitpod/ws-proxy/pkg/sshproxy"
@@ -978,27 +979,29 @@ func TestNoSSHGatewayRouter(t *testing.T) {
978979

979980
func TestRemoveSensitiveCookies(t *testing.T) {
980981
var (
981-
domain = "test-domain.com"
982-
sessionCookie = &http.Cookie{Domain: domain, Name: "_test_domain_com_", Value: "fobar"}
983-
sessionCookieJwt2 = &http.Cookie{Domain: domain, Name: "_test_domain_com_jwt2_", Value: "fobar"}
984-
portAuthCookie = &http.Cookie{Domain: domain, Name: "_test_domain_com_ws_77f6b236_3456_4b88_8284_81ca543a9d65_port_auth_", Value: "some-token"}
985-
ownerCookie = &http.Cookie{Domain: domain, Name: "_test_domain_com_ws_77f6b236_3456_4b88_8284_81ca543a9d65_owner_", Value: "some-other-token"}
986-
miscCookie = &http.Cookie{Domain: domain, Name: "some-other-cookie", Value: "I like cookies"}
987-
invalidCookieName = &http.Cookie{Domain: domain, Name: "foobar[0]", Value: "violates RFC6266"}
982+
domain = "test-domain.com"
983+
sessionCookie = &http.Cookie{Domain: domain, Name: "_test_domain_com_", Value: "fobar"}
984+
sessionCookieJwt2 = &http.Cookie{Domain: domain, Name: "_test_domain_com_jwt2_", Value: "fobar"}
985+
realGitpodSessionCookie = &http.Cookie{Domain: domain, Name: server_lib.CookieNameFromDomain(domain), Value: "fobar"}
986+
portAuthCookie = &http.Cookie{Domain: domain, Name: "_test_domain_com_ws_77f6b236_3456_4b88_8284_81ca543a9d65_port_auth_", Value: "some-token"}
987+
ownerCookie = &http.Cookie{Domain: domain, Name: "_test_domain_com_ws_77f6b236_3456_4b88_8284_81ca543a9d65_owner_", Value: "some-other-token"}
988+
miscCookie = &http.Cookie{Domain: domain, Name: "some-other-cookie", Value: "I like cookies"}
989+
invalidCookieName = &http.Cookie{Domain: domain, Name: "foobar[0]", Value: "violates RFC6266"}
988990
)
989991

990992
tests := []struct {
991993
Name string
992994
Input []*http.Cookie
993995
Expected []*http.Cookie
994996
}{
995-
{"no cookies", []*http.Cookie{}, []*http.Cookie{}},
996-
{"session cookie", []*http.Cookie{sessionCookie, miscCookie}, []*http.Cookie{miscCookie}},
997-
{"session cookie ending on _jwt2_", []*http.Cookie{sessionCookieJwt2, miscCookie}, []*http.Cookie{miscCookie}},
998-
{"portAuth cookie", []*http.Cookie{portAuthCookie, miscCookie}, []*http.Cookie{miscCookie}},
999-
{"owner cookie", []*http.Cookie{ownerCookie, miscCookie}, []*http.Cookie{miscCookie}},
1000-
{"misc cookie", []*http.Cookie{miscCookie}, []*http.Cookie{miscCookie}},
1001-
{"invalid cookie name", []*http.Cookie{invalidCookieName}, []*http.Cookie{invalidCookieName}},
997+
{Name: "no cookies", Input: []*http.Cookie{}, Expected: []*http.Cookie{}},
998+
{Name: "session cookie", Input: []*http.Cookie{sessionCookie, miscCookie}, Expected: []*http.Cookie{miscCookie}},
999+
{Name: "session cookie ending on _jwt2_", Input: []*http.Cookie{sessionCookieJwt2, miscCookie}, Expected: []*http.Cookie{miscCookie}},
1000+
{Name: "real Gitpod session cookie", Input: []*http.Cookie{realGitpodSessionCookie, miscCookie}, Expected: []*http.Cookie{miscCookie}},
1001+
{Name: "portAuth cookie", Input: []*http.Cookie{portAuthCookie, miscCookie}, Expected: []*http.Cookie{miscCookie}},
1002+
{Name: "owner cookie", Input: []*http.Cookie{ownerCookie, miscCookie}, Expected: []*http.Cookie{miscCookie}},
1003+
{Name: "misc cookie", Input: []*http.Cookie{miscCookie}, Expected: []*http.Cookie{miscCookie}},
1004+
{Name: "invalid cookie name", Input: []*http.Cookie{invalidCookieName}, Expected: []*http.Cookie{invalidCookieName}},
10021005
}
10031006
for _, test := range tests {
10041007
t.Run(test.Name, func(t *testing.T) {
@@ -1020,9 +1023,9 @@ func TestSensitiveCookieHandler(t *testing.T) {
10201023
Input string
10211024
Expected string
10221025
}{
1023-
{"no cookies", "", ""},
1024-
{"valid cookie", miscCookie.String(), `some-other-cookie="I like cookies";Domain=test-domain.com`},
1025-
{"invalid cookie", `foobar[0]="violates RFC6266"`, `foobar[0]="violates RFC6266"`},
1026+
{Name: "no cookies", Input: "", Expected: ""},
1027+
{Name: "valid cookie", Input: miscCookie.String(), Expected: `some-other-cookie="I like cookies";Domain=test-domain.com`},
1028+
{Name: "invalid cookie", Input: `foobar[0]="violates RFC6266"`, Expected: `foobar[0]="violates RFC6266"`},
10261029
}
10271030
for _, test := range tests {
10281031
t.Run(test.Name, func(t *testing.T) {

‎install/installer/BUILD.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ packages:
4141
- components/node-labeler:lib
4242
- dev/addlicense:app
4343
- components/spicedb:lib
44+
- components/server/go:lib
4445
env:
4546
- CGO_ENABLED=0
4647
argdeps:

‎install/installer/go.mod

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/gitpod-io/gitpod/installer
22

3-
go 1.22
3+
go 1.22.2
44

55
require (
66
github.com/Masterminds/semver v1.5.0
@@ -19,6 +19,7 @@ require (
1919
github.com/gitpod-io/gitpod/image-builder/api v0.0.0-00010101000000-000000000000
2020
github.com/gitpod-io/gitpod/openvsx-proxy v0.0.0-00010101000000-000000000000
2121
github.com/gitpod-io/gitpod/registry-facade/api v0.0.0-00010101000000-000000000000
22+
github.com/gitpod-io/gitpod/server/go v0.0.0-00010101000000-000000000000
2223
github.com/gitpod-io/gitpod/usage v0.0.0-00010101000000-000000000000
2324
github.com/gitpod-io/gitpod/ws-daemon v0.0.0-00010101000000-000000000000
2425
github.com/gitpod-io/gitpod/ws-daemon/api v0.0.0-00010101000000-000000000000
@@ -362,6 +363,8 @@ replace github.com/gitpod-io/gitpod/ws-proxy => ../../components/ws-proxy // lee
362363

363364
replace github.com/gitpod-io/gitpod/node-labeler => ../../components/node-labeler // leeway
364365

366+
replace github.com/gitpod-io/gitpod/server/go => ../../components/server/go // leeway
367+
365368
replace k8s.io/api => k8s.io/api v0.29.3 // leeway indirect from components/common-go:lib
366369

367370
replace k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.29.3 // leeway indirect from components/common-go:lib

‎install/installer/pkg/components/auth/config.go

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ package auth
66

77
import (
88
"fmt"
9-
"regexp"
109
"time"
1110

1211
"github.com/gitpod-io/gitpod/installer/pkg/common"
12+
server_lib "github.com/gitpod-io/gitpod/server/go/pkg/lib"
1313
corev1 "k8s.io/api/core/v1"
1414
)
1515

@@ -45,7 +45,7 @@ func GetConfig(ctx *common.RenderContext) ([]corev1.Volume, []corev1.VolumeMount
4545
Issuer: fmt.Sprintf("https://%s", ctx.Config.Domain),
4646
Cookie: CookieConfig{
4747
// Caution: changing these have security implications for the application. Make sure you understand what you're doing.
48-
Name: cookieNameFromDomain(ctx.Config.Domain),
48+
Name: server_lib.CookieNameFromDomain(ctx.Config.Domain),
4949
MaxAge: lifetime,
5050
SameSite: "lax",
5151
Secure: true,
@@ -54,9 +54,3 @@ func GetConfig(ctx *common.RenderContext) ([]corev1.Volume, []corev1.VolumeMount
5454
},
5555
}
5656
}
57-
58-
func cookieNameFromDomain(domain string) string {
59-
// replace all non-word characters with underscores
60-
derived := regexp.MustCompile(`[\W_]+`).ReplaceAllString(domain, "_")
61-
return "_" + derived + "_jwt2_"
62-
}

0 commit comments

Comments
 (0)