mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-14 00:33:44 -04:00
fix(security): stop leaking locked shared variables and proxy secrets
- References to locked (shown once) shared variables keep their reference text in the UI, copy action, and API instead of the locked value. - Remove the saved proxy configuration and validation logs from nested servers (for example destination.server) in API responses unless the token can read sensitive data. - The services list API now applies removeSensitiveData to every service. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Andras Bacsai
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
a5ec854e35
commit
aa2592b17c
@@ -0,0 +1,76 @@
|
||||
<?php
|
||||
|
||||
use App\Models\Application;
|
||||
use App\Models\Environment;
|
||||
use App\Models\EnvironmentVariable;
|
||||
use App\Models\InstanceSettings;
|
||||
use App\Models\Project;
|
||||
use App\Models\Server;
|
||||
use App\Models\SharedEnvironmentVariable;
|
||||
use App\Models\StandaloneDocker;
|
||||
use App\Models\Team;
|
||||
use App\Models\User;
|
||||
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||||
|
||||
uses(RefreshDatabase::class);
|
||||
|
||||
beforeEach(function () {
|
||||
InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
|
||||
Server::flushIdentityMap();
|
||||
|
||||
$this->team = Team::factory()->create();
|
||||
$this->user = User::factory()->create();
|
||||
$this->team->members()->attach($this->user->id, ['role' => 'owner']);
|
||||
session(['currentTeam' => $this->team]);
|
||||
|
||||
$this->bearerToken = $this->user->createToken('test-token', ['read', 'read:sensitive'])->plainTextToken;
|
||||
|
||||
$server = Server::factory()->create(['team_id' => $this->team->id]);
|
||||
$destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
|
||||
$project = Project::factory()->create(['team_id' => $this->team->id]);
|
||||
$environment = Environment::factory()->create(['project_id' => $project->id]);
|
||||
$this->application = Application::factory()->create([
|
||||
'environment_id' => $environment->id,
|
||||
'destination_id' => $destination->id,
|
||||
'destination_type' => StandaloneDocker::class,
|
||||
]);
|
||||
});
|
||||
|
||||
function createLockedSharedReferenceForApiTest(bool $locked): void
|
||||
{
|
||||
SharedEnvironmentVariable::create([
|
||||
'key' => 'DB_SECRET',
|
||||
'value' => 'locked-shared-secret',
|
||||
'type' => 'team',
|
||||
'team_id' => test()->team->id,
|
||||
'is_shown_once' => $locked,
|
||||
]);
|
||||
EnvironmentVariable::create([
|
||||
'key' => 'DATABASE_PASSWORD',
|
||||
'value' => '{{team.DB_SECRET}}',
|
||||
'resourceable_type' => Application::class,
|
||||
'resourceable_id' => test()->application->id,
|
||||
]);
|
||||
}
|
||||
|
||||
it('does not reveal a locked shared variable through a reference in the application envs API', function () {
|
||||
createLockedSharedReferenceForApiTest(locked: true);
|
||||
|
||||
$response = $this->withHeaders(['Authorization' => 'Bearer '.$this->bearerToken])
|
||||
->getJson("/api/v1/applications/{$this->application->uuid}/envs");
|
||||
|
||||
$response->assertOk();
|
||||
$env = collect($response->json())->firstWhere('key', 'DATABASE_PASSWORD');
|
||||
expect($env['real_value'])->toBe('{{team.DB_SECRET}}')
|
||||
->and($response->getContent())->not->toContain('locked-shared-secret');
|
||||
});
|
||||
|
||||
it('still resolves an unlocked shared variable reference in the application envs API', function () {
|
||||
createLockedSharedReferenceForApiTest(locked: false);
|
||||
|
||||
$response = $this->withHeaders(['Authorization' => 'Bearer '.$this->bearerToken])
|
||||
->getJson("/api/v1/applications/{$this->application->uuid}/envs");
|
||||
|
||||
$response->assertOk();
|
||||
expect(collect($response->json())->firstWhere('key', 'DATABASE_PASSWORD')['real_value'])->toBe('locked-shared-secret');
|
||||
});
|
||||
@@ -0,0 +1,108 @@
|
||||
<?php
|
||||
|
||||
use App\Models\Application;
|
||||
use App\Models\Environment;
|
||||
use App\Models\InstanceSettings;
|
||||
use App\Models\Project;
|
||||
use App\Models\Server;
|
||||
use App\Models\Service;
|
||||
use App\Models\StandalonePostgresql;
|
||||
use App\Models\Team;
|
||||
use App\Models\User;
|
||||
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||||
use Illuminate\Support\Facades\DB;
|
||||
|
||||
uses(RefreshDatabase::class);
|
||||
|
||||
const NESTED_PROXY_SECRET = 'CF_DNS_API_TOKEN=nested-proxy-config-secret';
|
||||
|
||||
function nestedProxyApiToken(User $user, Team $team, array $abilities): string
|
||||
{
|
||||
session(['currentTeam' => $team]);
|
||||
$token = $user->createToken('nested-proxy-test', $abilities);
|
||||
DB::table('personal_access_tokens')->where('id', $token->accessToken->id)->update([
|
||||
'team_id' => $team->id,
|
||||
]);
|
||||
|
||||
return $token->plainTextToken;
|
||||
}
|
||||
|
||||
beforeEach(function () {
|
||||
Server::flushIdentityMap();
|
||||
InstanceSettings::query()->delete();
|
||||
$settings = new InstanceSettings;
|
||||
$settings->id = 0;
|
||||
$settings->save();
|
||||
|
||||
$this->team = Team::factory()->create();
|
||||
$this->user = User::factory()->create();
|
||||
$this->team->members()->attach($this->user->id, ['role' => 'owner']);
|
||||
session(['currentTeam' => $this->team]);
|
||||
|
||||
$this->server = Server::factory()->create(['team_id' => $this->team->id]);
|
||||
$this->server->proxy->set('last_saved_proxy_configuration', "services:\n traefik:\n environment:\n - ".NESTED_PROXY_SECRET."\n");
|
||||
$this->server->save();
|
||||
|
||||
$this->project = Project::factory()->create(['team_id' => $this->team->id]);
|
||||
$this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
|
||||
$destination = $this->server->standaloneDockers()->firstOrFail();
|
||||
|
||||
$this->application = Application::create([
|
||||
'name' => 'nested-proxy-app',
|
||||
'git_repository' => 'https://github.com/test/test',
|
||||
'git_branch' => 'main',
|
||||
'build_pack' => 'nixpacks',
|
||||
'ports_exposes' => '3000',
|
||||
'environment_id' => $this->environment->id,
|
||||
'destination_id' => $destination->id,
|
||||
'destination_type' => $destination->getMorphClass(),
|
||||
]);
|
||||
|
||||
$this->database = StandalonePostgresql::create([
|
||||
'name' => 'nested-proxy-db',
|
||||
'postgres_user' => 'postgres',
|
||||
'postgres_password' => 'password',
|
||||
'postgres_db' => 'app',
|
||||
'image' => 'postgres:16-alpine',
|
||||
'environment_id' => $this->environment->id,
|
||||
'destination_id' => $destination->id,
|
||||
'destination_type' => $destination->getMorphClass(),
|
||||
]);
|
||||
|
||||
$this->service = Service::factory()->create([
|
||||
'server_id' => $this->server->id,
|
||||
'destination_id' => $destination->id,
|
||||
'destination_type' => $destination->getMorphClass(),
|
||||
'environment_id' => $this->environment->id,
|
||||
]);
|
||||
});
|
||||
|
||||
dataset('endpoints with nested server data', [
|
||||
'applications list' => [fn () => '/api/v1/applications'],
|
||||
'application detail' => [fn () => "/api/v1/applications/{$this->application->uuid}"],
|
||||
'databases list' => [fn () => '/api/v1/databases'],
|
||||
'database detail' => [fn () => "/api/v1/databases/{$this->database->uuid}"],
|
||||
'services list' => [fn () => '/api/v1/services'],
|
||||
'service detail' => [fn () => "/api/v1/services/{$this->service->uuid}"],
|
||||
'resources list' => [fn () => '/api/v1/resources'],
|
||||
]);
|
||||
|
||||
test('read token does not receive the saved proxy configuration of a nested server', function (Closure $endpoint) {
|
||||
$token = nestedProxyApiToken($this->user, $this->team, ['read']);
|
||||
|
||||
$response = $this->withToken($token)->getJson($endpoint->call($this));
|
||||
|
||||
$response->assertOk();
|
||||
expect($response->getContent())
|
||||
->not->toContain('nested-proxy-config-secret')
|
||||
->not->toContain('last_saved_proxy_configuration');
|
||||
})->with('endpoints with nested server data');
|
||||
|
||||
test('read sensitive token still receives the saved proxy configuration of a nested server', function (Closure $endpoint) {
|
||||
$token = nestedProxyApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
||||
|
||||
$response = $this->withToken($token)->getJson($endpoint->call($this));
|
||||
|
||||
$response->assertOk();
|
||||
expect($response->getContent())->toContain('nested-proxy-config-secret');
|
||||
})->with('endpoints with nested server data');
|
||||
@@ -0,0 +1,112 @@
|
||||
<?php
|
||||
|
||||
use App\Livewire\Project\Shared\EnvironmentVariable\Show;
|
||||
use App\Models\Application;
|
||||
use App\Models\Environment;
|
||||
use App\Models\EnvironmentVariable;
|
||||
use App\Models\InstanceSettings;
|
||||
use App\Models\Project;
|
||||
use App\Models\Server;
|
||||
use App\Models\SharedEnvironmentVariable;
|
||||
use App\Models\StandaloneDocker;
|
||||
use App\Models\Team;
|
||||
use App\Models\User;
|
||||
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||||
use Livewire\Livewire;
|
||||
|
||||
uses(RefreshDatabase::class);
|
||||
|
||||
beforeEach(function () {
|
||||
InstanceSettings::forceCreate(['id' => 0]);
|
||||
Server::flushIdentityMap();
|
||||
|
||||
$this->user = User::factory()->create();
|
||||
$this->team = Team::factory()->create();
|
||||
$this->team->members()->attach($this->user, ['role' => 'owner']);
|
||||
$this->project = Project::factory()->create(['team_id' => $this->team->id]);
|
||||
$this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
|
||||
$this->server = Server::factory()->create(['team_id' => $this->team->id]);
|
||||
$destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
|
||||
$this->application = Application::factory()->create([
|
||||
'environment_id' => $this->environment->id,
|
||||
'destination_id' => $destination->id,
|
||||
'destination_type' => StandaloneDocker::class,
|
||||
]);
|
||||
|
||||
$this->actingAs($this->user);
|
||||
session(['currentTeam' => $this->team]);
|
||||
});
|
||||
|
||||
function createSharedVariableForLockTest(string $type, bool $locked): SharedEnvironmentVariable
|
||||
{
|
||||
$owner = match ($type) {
|
||||
'team' => [],
|
||||
'project' => ['project_id' => test()->project->id],
|
||||
'environment' => ['project_id' => test()->project->id, 'environment_id' => test()->environment->id],
|
||||
'server' => ['server_id' => test()->server->id],
|
||||
};
|
||||
|
||||
return SharedEnvironmentVariable::create([
|
||||
'key' => 'DB_SECRET',
|
||||
'value' => 'review-fix-e-shared-secret',
|
||||
'type' => $type,
|
||||
'team_id' => test()->team->id,
|
||||
'is_shown_once' => $locked,
|
||||
...$owner,
|
||||
]);
|
||||
}
|
||||
|
||||
function createReferencingVariableForLockTest(string $value): EnvironmentVariable
|
||||
{
|
||||
return EnvironmentVariable::create([
|
||||
'key' => 'DATABASE_PASSWORD',
|
||||
'value' => $value,
|
||||
'resourceable_type' => Application::class,
|
||||
'resourceable_id' => test()->application->id,
|
||||
]);
|
||||
}
|
||||
|
||||
test('copying a reference does not reveal a locked shared variable', function (string $type) {
|
||||
createSharedVariableForLockTest($type, locked: true);
|
||||
|
||||
Livewire::test(Show::class, ['env' => createReferencingVariableForLockTest("{{{$type}.DB_SECRET}}"), 'type' => 'application'])
|
||||
->call('copyValue')
|
||||
->assertReturned("{{{$type}.DB_SECRET}}");
|
||||
})->with(['team', 'project', 'environment', 'server']);
|
||||
|
||||
test('copying an embedded reference does not reveal a locked shared variable', function () {
|
||||
createSharedVariableForLockTest('team', locked: true);
|
||||
|
||||
Livewire::test(Show::class, ['env' => createReferencingVariableForLockTest('postgres://app:{{team.DB_SECRET}}@db'), 'type' => 'application'])
|
||||
->call('copyValue')
|
||||
->assertReturned('postgres://app:{{team.DB_SECRET}}@db');
|
||||
});
|
||||
|
||||
test('the resolved value in the editor does not reveal a locked shared variable', function (string $type) {
|
||||
createSharedVariableForLockTest($type, locked: true);
|
||||
|
||||
$component = Livewire::test(Show::class, ['env' => createReferencingVariableForLockTest("{{{$type}.DB_SECRET}}"), 'type' => 'application'])
|
||||
->call('loadValues');
|
||||
|
||||
expect($component->get('real_value'))->not->toContain('review-fix-e-shared-secret')
|
||||
->and(json_encode($component->snapshot))->not->toContain('review-fix-e-shared-secret');
|
||||
})->with(['team', 'project', 'environment', 'server']);
|
||||
|
||||
test('the editor and copy still resolve an unlocked shared variable', function () {
|
||||
createSharedVariableForLockTest('team', locked: false);
|
||||
|
||||
Livewire::test(Show::class, ['env' => createReferencingVariableForLockTest('{{team.DB_SECRET}}'), 'type' => 'application'])
|
||||
->call('loadValues')
|
||||
->assertSet('real_value', 'review-fix-e-shared-secret')
|
||||
->call('copyValue')
|
||||
->assertReturned('review-fix-e-shared-secret');
|
||||
});
|
||||
|
||||
test('deployments still receive the value of a locked shared variable', function (string $type) {
|
||||
createSharedVariableForLockTest($type, locked: true);
|
||||
$env = createReferencingVariableForLockTest("{{{$type}.DB_SECRET}}");
|
||||
|
||||
expect($env->getResolvedValueWithServer($this->server))->toBe('review-fix-e-shared-secret')
|
||||
->and($env->get_real_environment_variables_with_server($env->value, $this->application, $this->server))->toBe('review-fix-e-shared-secret')
|
||||
->and($env->fresh()->real_value)->toBe('review-fix-e-shared-secret');
|
||||
})->with(['team', 'project', 'environment', 'server']);
|
||||
Reference in New Issue
Block a user