fix(proxy): restrict JWT signed urls to the allowed HTTP methods - #3481
Conversation
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Coverage variation | Report missing for 81536bb1 |
| Diff coverage | ✅ 100.00% diff coverage |
Coverage variation details
Coverable lines Covered lines Coverage Common ancestor commit (81536bb) Report Missing Report Missing Report Missing Head commit (7f7a938) 88333 20803 23.55% Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch:
<coverage of head commit> - <coverage of common ancestor commit>
Diff coverage details
Coverable lines Covered lines Diff coverage Pull request (#3481) 9 9 100.00% Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified:
<covered lines added or modified>/<coverable lines added or modified> * 100%
1 Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
fe12eea to
7f7a938
Compare
The legacy OC-Signature path already rejects methods outside PRE_SIGNED_URL_ALLOWED_HTTP_METHODS, the JWT path did not. A leaked signed download url could be used for PUT, DELETE, MOVE or PROPFIND as the signing user for the lifetime of the signature.
2 participants
The proxy verifies JWT signed URLs (
oc-jwt-sig) without checking the request method, while the legacyOC-Signaturepath enforcesPRE_SIGNED_URL_ALLOWED_HTTP_METHODS(defaultGET). A signed download URL handed out viaoc:downloadURLor, with #3248,@microsoft.graph.downloadUrltherefore also authenticates PUT, DELETE, MOVE and PROPFIND as the signing user until it expires.Applies the same allowed-methods check to the JWT path.