Skip to content

Commit

Permalink
Merge 5a88d8f into c559bb3
Browse files Browse the repository at this point in the history
  • Loading branch information
@molotkov-and
molotkov-and authored Sep 11, 2024
2 parents c559bb3 + 5a88d8f commit e7566f3
Show file tree
Hide file tree
Showing 2 changed files with 78 additions and 3 deletions.
15 changes: 14 additions & 1 deletion ydb/mvp/oidc_proxy/oidc_protected_page.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -229,7 +229,20 @@ class THandlerSessionServiceCheck : public NActors::TActorBootstrapped<THandlerS
TString GetFixedLocationHeader(TStringBuf location) {
TStringBuf scheme, host, uri;
NHttp::CrackURL(ProtectedPageUrl, scheme, host, uri);
return TStringBuilder() << '/' << host << location;
if (location.StartsWith("//")) {
return TStringBuilder() << '/' << (scheme.empty() ? "" : TString(scheme) + "://") << location.SubStr(2);
} else if (location.StartsWith('/')) {
return TStringBuilder() << '/'
<< (scheme.empty() ? "" : TString(scheme) + "://")
<< host << location;
} else {
TStringBuf locScheme, locHost, locUri;
NHttp::CrackURL(location, locScheme, locHost, locUri);
if (!locScheme.empty()) {
return TStringBuilder() << '/' << location;
}
}
return TString(location);
}

NHttp::THttpOutgoingResponsePtr CreateResponseForbiddenHost() {
Expand Down
66 changes: 64 additions & 2 deletions ydb/mvp/oidc_proxy/oidc_proxy_ut.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -277,7 +277,7 @@ Y_UNIT_TEST_SUITE(Mvp) {
std::unique_ptr<grpc::Server> sessionServer(builder.BuildAndStart());

NHttp::THttpIncomingRequestPtr incomingRequest = new NHttp::THttpIncomingRequest();
EatWholeString(incomingRequest, "GET /" + allowedProxyHost + "/counters HTTP/1.1\r\n"
EatWholeString(incomingRequest, "GET /http://" + allowedProxyHost + "/counters HTTP/1.1\r\n"
"Host: oidcproxy.net\r\n"
"Cookie: yc_session=allowed_session_cookie\r\n\r\n");
runtime.Send(new IEventHandle(target, edge, new NHttp::TEvHttpProxy::TEvHttpIncomingRequest(incomingRequest)));
Expand All @@ -288,6 +288,8 @@ Y_UNIT_TEST_SUITE(Mvp) {
UNIT_ASSERT_STRINGS_EQUAL(outgoingRequestEv->Request->URL, "/counters");
UNIT_ASSERT_STRING_CONTAINS(outgoingRequestEv->Request->Headers, "Authorization: Bearer protected_page_iam_token");
UNIT_ASSERT_EQUAL(outgoingRequestEv->Request->Secure, false);

// Location start with '/'
NHttp::THttpIncomingResponsePtr incomingResponse = new NHttp::THttpIncomingResponse(outgoingRequestEv->Request);
EatWholeString(incomingResponse, "HTTP/1.1 307 Temporary Redirect\r\n"
"Connection: close\r\n"
Expand All @@ -297,7 +299,67 @@ Y_UNIT_TEST_SUITE(Mvp) {

auto outgoingResponseEv = runtime.GrabEdgeEvent<NHttp::TEvHttpProxy::TEvHttpOutgoingResponse>(handle);
UNIT_ASSERT_STRINGS_EQUAL(outgoingResponseEv->Response->Status, "307");
UNIT_ASSERT_STRING_CONTAINS(outgoingResponseEv->Response->Headers, "Location: /" + allowedProxyHost + "/node/12345/counters");
UNIT_ASSERT_STRING_CONTAINS(outgoingResponseEv->Response->Headers, "Location: /http://" + allowedProxyHost + "/node/12345/counters");

// Location start with "//"
runtime.Send(new IEventHandle(target, edge, new NHttp::TEvHttpProxy::TEvHttpIncomingRequest(incomingRequest)));
outgoingRequestEv = runtime.GrabEdgeEvent<NHttp::TEvHttpProxy::TEvHttpOutgoingRequest>(handle);

incomingResponse = new NHttp::THttpIncomingResponse(outgoingRequestEv->Request);
EatWholeString(incomingResponse, "HTTP/1.1 302 Found\r\n"
"Connection: close\r\n"
"Location: //new.oidc.proxy.host:1234/node/12345/counters\r\n"
"Content-Length:0\r\n\r\n");
runtime.Send(new IEventHandle(handle->Sender, edge, new NHttp::TEvHttpProxy::TEvHttpIncomingResponse(outgoingRequestEv->Request, incomingResponse)));

outgoingResponseEv = runtime.GrabEdgeEvent<NHttp::TEvHttpProxy::TEvHttpOutgoingResponse>(handle);
UNIT_ASSERT_STRINGS_EQUAL(outgoingResponseEv->Response->Status, "302");
UNIT_ASSERT_STRING_CONTAINS(outgoingResponseEv->Response->Headers, "Location: /http://new.oidc.proxy.host:1234/node/12345/counters");

// Location start with ".."
runtime.Send(new IEventHandle(target, edge, new NHttp::TEvHttpProxy::TEvHttpIncomingRequest(incomingRequest)));
outgoingRequestEv = runtime.GrabEdgeEvent<NHttp::TEvHttpProxy::TEvHttpOutgoingRequest>(handle);

incomingResponse = new NHttp::THttpIncomingResponse(outgoingRequestEv->Request);
EatWholeString(incomingResponse, "HTTP/1.1 302 Found\r\n"
"Connection: close\r\n"
"Location: ../node/12345/counters\r\n"
"Content-Length:0\r\n\r\n");
runtime.Send(new IEventHandle(handle->Sender, edge, new NHttp::TEvHttpProxy::TEvHttpIncomingResponse(outgoingRequestEv->Request, incomingResponse)));

outgoingResponseEv = runtime.GrabEdgeEvent<NHttp::TEvHttpProxy::TEvHttpOutgoingResponse>(handle);
UNIT_ASSERT_STRINGS_EQUAL(outgoingResponseEv->Response->Status, "302");
UNIT_ASSERT_STRING_CONTAINS(outgoingResponseEv->Response->Headers, "Location: ../node/12345/counters");

// Location is absolute URL
runtime.Send(new IEventHandle(target, edge, new NHttp::TEvHttpProxy::TEvHttpIncomingRequest(incomingRequest)));
outgoingRequestEv = runtime.GrabEdgeEvent<NHttp::TEvHttpProxy::TEvHttpOutgoingRequest>(handle);

incomingResponse = new NHttp::THttpIncomingResponse(outgoingRequestEv->Request);
EatWholeString(incomingResponse, "HTTP/1.1 302 Found\r\n"
"Connection: close\r\n"
"Location: https://some.new.oidc.host:9876/counters/v1\r\n"
"Content-Length:0\r\n\r\n");
runtime.Send(new IEventHandle(handle->Sender, edge, new NHttp::TEvHttpProxy::TEvHttpIncomingResponse(outgoingRequestEv->Request, incomingResponse)));

outgoingResponseEv = runtime.GrabEdgeEvent<NHttp::TEvHttpProxy::TEvHttpOutgoingResponse>(handle);
UNIT_ASSERT_STRINGS_EQUAL(outgoingResponseEv->Response->Status, "302");
UNIT_ASSERT_STRING_CONTAINS(outgoingResponseEv->Response->Headers, "Location: /https://some.new.oidc.host:9876/counters/v1");

// Location is sub-resources URL
runtime.Send(new IEventHandle(target, edge, new NHttp::TEvHttpProxy::TEvHttpIncomingRequest(incomingRequest)));
outgoingRequestEv = runtime.GrabEdgeEvent<NHttp::TEvHttpProxy::TEvHttpOutgoingRequest>(handle);

incomingResponse = new NHttp::THttpIncomingResponse(outgoingRequestEv->Request);
EatWholeString(incomingResponse, "HTTP/1.1 302 Found\r\n"
"Connection: close\r\n"
"Location: v1/\r\n"
"Content-Length:0\r\n\r\n");
runtime.Send(new IEventHandle(handle->Sender, edge, new NHttp::TEvHttpProxy::TEvHttpIncomingResponse(outgoingRequestEv->Request, incomingResponse)));

outgoingResponseEv = runtime.GrabEdgeEvent<NHttp::TEvHttpProxy::TEvHttpOutgoingResponse>(handle);
UNIT_ASSERT_STRINGS_EQUAL(outgoingResponseEv->Response->Status, "302");
UNIT_ASSERT_STRING_CONTAINS(outgoingResponseEv->Response->Headers, "Location: v1/");
}


Expand Down

0 comments on commit e7566f3

Please sign in to comment.