Skip to content

Strip auth on rel links only when they leave the origin #27862

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Chris Peterson (chris-peterson) wants to merge 1 commit into
base: release/v7.6.6
Choose a base branch
from
+46 −5
Open

Strip auth on rel links only when they leave the origin #27862

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions ...owerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -554,7 +554,12 @@ protected override void ProcessRecord()
HttpClient client = GetHttpClient(handleRedirect);

int followedRelLink = 0;
Uri uri = Uri;

// A rel link is a URL the same server advertised in its own 'Link' header, not a redirect,
// so the credentials the caller supplied still apply. Treat a followed link as a credential
// boundary only when it leaves the origin the caller requested.
Uri uri = CheckProtocol(Uri);
string originAuthority = uri.GetLeftPart(UriPartial.Authority);
do
{
if (followedRelLink > 0)
Expand All @@ -567,7 +572,10 @@ protected override void ProcessRecord()
WriteVerbose(linkVerboseMsg);
}

using (HttpRequestMessage request = GetRequest(uri, isRedirect: followedRelLink > 0))
bool relLinkLeavesOrigin = followedRelLink > 0
&& !string.Equals(originAuthority, uri.GetLeftPart(UriPartial.Authority), StringComparison.OrdinalIgnoreCase);

using (HttpRequestMessage request = GetRequest(uri, isRedirect: relLinkLeavesOrigin))
Comment on lines +575 to +578
{
FillRequestStream(request);
try
Expand Down
28 changes: 26 additions & 2 deletions test/powershell/Modules/Microsoft.PowerShell.Utility/WebCmdlets.Tests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3029,16 +3029,40 @@ Describe "Invoke-RestMethod tests" -Tags "Feature", "RequireAdminOnWindows" {
1..$maxLinksToFollow | ForEach-Object { $result.Output[$_ - 1].linknumber | Should -BeExactly $_ }
}

It "Validate Invoke-RestMethod -FollowRelLink strips the authorization header on followed relation links by default" {
It "Validate Invoke-RestMethod -FollowRelLink keeps the authorization header on relation links within the origin" {
$uri = Get-WebListenerUrl -Test 'Link' -Query @{maxlinks = 3}
$command = "Invoke-RestMethod -Uri '$uri' -FollowRelLink -Headers @{Authorization = 'test'}"
$result = ExecuteWebCommand -command $command

$result.Error | Should -BeNullOrEmpty
$result.Output.Count | Should -BeExactly 3
$result.Output[0].headers.Authorization | Should -BeExactly 'test'
$result.Output[1].headers.Authorization | Should -BeExactly 'test'
$result.Output[2].headers.Authorization | Should -BeExactly 'test'
}

It "Validate Invoke-RestMethod -FollowRelLink strips the authorization header on a relation link that leaves the origin" {
$crossOrigin = Get-WebListenerUrl -Https
$uri = Get-WebListenerUrl -Test 'Link' -Query @{maxlinks = 2; nextauthority = $crossOrigin.GetLeftPart([System.UriPartial]::Authority)}
$command = "Invoke-RestMethod -Uri '$uri' -FollowRelLink -SkipCertificateCheck -Headers @{Authorization = 'test'}"
$result = ExecuteWebCommand -command $command

$result.Error | Should -BeNullOrEmpty
$result.Output.Count | Should -BeExactly 2
$result.Output[0].headers.Authorization | Should -BeExactly 'test'
$result.Output[1].headers.Authorization | Should -BeNullOrEmpty
$result.Output[2].headers.Authorization | Should -BeNullOrEmpty
}

It "Validate Invoke-RestMethod -FollowRelLink -PreserveAuthorizationOnRedirect keeps the authorization header across origins" {
$crossOrigin = Get-WebListenerUrl -Https
$uri = Get-WebListenerUrl -Test 'Link' -Query @{maxlinks = 2; nextauthority = $crossOrigin.GetLeftPart([System.UriPartial]::Authority)}
$command = "Invoke-RestMethod -Uri '$uri' -FollowRelLink -PreserveAuthorizationOnRedirect -SkipCertificateCheck -Headers @{Authorization = 'test'}"
$result = ExecuteWebCommand -command $command

$result.Error | Should -BeNullOrEmpty
$result.Output.Count | Should -BeExactly 2
$result.Output[0].headers.Authorization | Should -BeExactly 'test'
$result.Output[1].headers.Authorization | Should -BeExactly 'test'
}

It "Validate Invoke-RestMethod quietly ignores invalid Link Headers if -FollowRelLink is specified: <type>" -TestCases @(
Expand Down
11 changes: 10 additions & 1 deletion test/tools/WebListener/Controllers/LinkController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,16 @@ public JsonResult Index()

if (!skipNextLink && maxLinks > 1 && linkNumber < maxLinks)
{
linkList.Add(GetLink(baseUri: baseUri, maxLinks: maxLinks, linkNumber: linkNumber + 1, type: type, whitespace: whitespace, rel: "next"));
// 'nextauthority' advertises the next link on another scheme/host/port, which lets tests
// cover a rel link that crosses an origin. Pass it the authority of another listener port.
string nextBaseUri = baseUri;
if (Request.Query.TryGetValue("nextauthority", out StringValues nextAuthoritySV)
&& Uri.TryCreate(nextAuthoritySV.FirstOrDefault(), UriKind.Absolute, out Uri nextAuthority))
{
nextBaseUri = new Uri(nextAuthority, new Uri(baseUri).AbsolutePath).AbsoluteUri;
Comment on lines +84 to +87
}

linkList.Add(GetLink(baseUri: nextBaseUri, maxLinks: maxLinks, linkNumber: linkNumber + 1, type: type, whitespace: whitespace, rel: "next"));
}

StringValues linkHeader;
Expand Down