From ce93a5136d22d704b6d9325a310de1197ec4e353 Mon Sep 17 00:00:00 2001 From: Alex Tugarev Date: Fri, 15 Jul 2022 10:12:41 +0000 Subject: [PATCH] Test if auth host is reachable --- components/server/package.json | 1 + .../server/src/auth/auth-provider-service.ts | 8 ++- .../src/workspace/gitpod-server-impl.ts | 14 +---- yarn.lock | 60 +++++++++++++++++++ 4 files changed, 71 insertions(+), 12 deletions(-) diff --git a/components/server/package.json b/components/server/package.json index 9647a1257ee8ca..f5e4a8c2358f30 100644 --- a/components/server/package.json +++ b/components/server/package.json @@ -61,6 +61,7 @@ "google-protobuf": "^3.18.0-rc.2", "heapdump": "^0.3.15", "inversify": "^5.0.1", + "is-reachable": "^5.2.1", "js-yaml": "^3.10.0", "json-stream": "^1.0.0", "lodash.debounce": "^4.0.8", diff --git a/components/server/src/auth/auth-provider-service.ts b/components/server/src/auth/auth-provider-service.ts index c706aeb25761ae..e134d80ae430a9 100644 --- a/components/server/src/auth/auth-provider-service.ts +++ b/components/server/src/auth/auth-provider-service.ts @@ -15,6 +15,7 @@ import { oauthUrls as gitlabUrls } from "../gitlab/gitlab-urls"; import { oauthUrls as bbsUrls } from "../bitbucket-server/bitbucket-server-urls"; import { oauthUrls as bbUrls } from "../bitbucket/bitbucket-urls"; import { log } from "@gitpod/gitpod-protocol/lib/util/logging"; +import isReachable = require("is-reachable"); @injectable() export class AuthProviderService { @@ -172,7 +173,12 @@ export class AuthProviderService { } protected callbackUrl = (host: string) => { - const pathname = `/auth/${host}/callback`; + const safeHost = host.replace(":", "_"); + const pathname = `/auth/${safeHost}/callback`; return this.config.hostUrl.with({ pathname }).toString(); }; + + async isHostReachable(host: string) { + return await isReachable(host, { timeout: 2000 }); + } } diff --git a/components/server/src/workspace/gitpod-server-impl.ts b/components/server/src/workspace/gitpod-server-impl.ts index 0c026b5e399a23..5af0bacb29203d 100644 --- a/components/server/src/workspace/gitpod-server-impl.ts +++ b/components/server/src/workspace/gitpod-server-impl.ts @@ -2864,14 +2864,6 @@ export class GitpodServerImpl implements GitpodServerWithTracing, Disposable { throw error; } - // from https://stackoverflow.com/questions/106179/regular-expression-to-match-dns-hostname-or-ip-address/106223#106223 - // adapted to allow for hostnames - // from [foo.bar] pumped up to [foo.(foo.)bar] - // and also for a trailing path segments - // for example [foo.bar/gitlab] - protected validHostNameRegexp = - /^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)+([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])(\/([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]))?$/; - async updateOwnAuthProvider( ctx: TraceContext, { entry }: GitpodServer.UpdateOwnAuthProviderParams, @@ -2896,9 +2888,9 @@ export class GitpodServerImpl implements GitpodServerWithTracing, Disposable { const host = safeProvider.host && safeProvider.host.toLowerCase(); - if (!this.validHostNameRegexp.exec(host)) { - log.debug(`Invalid auth provider host.`, { entry, safeProvider }); - throw new Error("Invalid host name."); + if (!(await this.authProviderService.isHostReachable(host))) { + log.debug(`Host could not be reached.`, { entry, safeProvider }); + throw new Error("Host could not be reached."); } const hostContext = this.hostContextProvider.get(host); diff --git a/yarn.lock b/yarn.lock index 9134e633c4d3ae..15ba438a9fc0bd 100644 --- a/yarn.lock +++ b/yarn.lock @@ -10086,11 +10086,30 @@ is-plain-object@^5.0.0: resolved "https://registry.yarnpkg.com/is-plain-object/-/is-plain-object-5.0.0.tgz#4427f50ab3429e9025ea7d52e9043a9ef4159344" integrity sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q== +is-port-reachable@^3.0.0: + version "3.1.0" + resolved "https://registry.yarnpkg.com/is-port-reachable/-/is-port-reachable-3.1.0.tgz#f6668d3bca9c36b07f737c48a8f875ab0653cd2b" + integrity sha512-vjc0SSRNZ32s9SbZBzGaiP6YVB+xglLShhgZD/FHMZUXBvQWaV9CtzgeVhjccFJrI6RAMV+LX7NYxueW/A8W5A== + is-potential-custom-element-name@^1.0.1: version "1.0.1" resolved "https://registry.yarnpkg.com/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz#171ed6f19e3ac554394edf78caa05784a45bebb5" integrity sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ== +is-reachable@^5.2.1: + version "5.2.1" + resolved "https://registry.yarnpkg.com/is-reachable/-/is-reachable-5.2.1.tgz#4bba5ba32f60723404d5f95b7ecd895644c776f3" + integrity sha512-ViPrrlmt9FTTclYbz6mL/PFyF1TXSpJ9y/zw9QMVJxbhU/7DFkvk/5cTv7S0sXtqbJj32zZ+jKpNAjrYTUZBPQ== + dependencies: + arrify "^2.0.1" + got "^11.7.0" + is-port-reachable "^3.0.0" + p-any "^3.0.0" + p-timeout "^3.2.0" + prepend-http "^3.0.1" + router-ips "^1.0.0" + url-parse "^1.5.10" + is-regex@^1.0.3, is-regex@^1.0.4, is-regex@^1.1.1, is-regex@^1.1.4: version "1.1.4" resolved "https://registry.yarnpkg.com/is-regex/-/is-regex-1.1.4.tgz#eef5663cd59fa4c0ae339505323df6854bb15958" @@ -12686,6 +12705,14 @@ ospath@^1.2.2: resolved "https://registry.yarnpkg.com/ospath/-/ospath-1.2.2.tgz#1276639774a3f8ef2572f7fe4280e0ea4550c07b" integrity sha1-EnZjl3Sj+O8lcvf+QoDg6kVQwHs= +p-any@^3.0.0: + version "3.0.0" + resolved "https://registry.yarnpkg.com/p-any/-/p-any-3.0.0.tgz#79847aeed70b5d3a10ea625296c0c3d2e90a87b9" + integrity sha512-5rqbqfsRWNb0sukt0awwgJMlaep+8jV45S15SKKB34z4UuzjcofIfnriCBhWjZP2jbVtjt9yRl7buB6RlKsu9w== + dependencies: + p-cancelable "^2.0.0" + p-some "^5.0.0" + p-cancelable@^1.0.0: version "1.1.0" resolved "https://registry.yarnpkg.com/p-cancelable/-/p-cancelable-1.1.0.tgz#d078d15a3af409220c886f1d9a0ca2e441ab26cc" @@ -12777,11 +12804,26 @@ p-retry@^3.0.1: dependencies: retry "^0.12.0" +p-some@^5.0.0: + version "5.0.0" + resolved "https://registry.yarnpkg.com/p-some/-/p-some-5.0.0.tgz#8b730c74b4fe5169d7264a240ad010b6ebc686a4" + integrity sha512-Js5XZxo6vHjB9NOYAzWDYAIyyiPvva0DWESAIWIK7uhSpGsyg5FwUPxipU/SOQx5x9EqhOh545d1jo6cVkitig== + dependencies: + aggregate-error "^3.0.0" + p-cancelable "^2.0.0" + p-throttle@^4.1.1: version "4.1.1" resolved "https://registry.yarnpkg.com/p-throttle/-/p-throttle-4.1.1.tgz#80b1fbd358af40a8bfa1667f9dc8b72b714ad692" integrity sha512-TuU8Ato+pRTPJoDzYD4s7ocJYcNSEZRvlxoq3hcPI2kZDZ49IQ1Wkj7/gDJc3X7XiEAAvRGtDzdXJI0tC3IL1g== +p-timeout@^3.2.0: + version "3.2.0" + resolved "https://registry.yarnpkg.com/p-timeout/-/p-timeout-3.2.0.tgz#c7e17abc971d2a7962ef83626b35d635acf23dfe" + integrity sha512-rhIwUycgwwKcP9yTOOFK/AKsAopjjCakVqLHePO3CC6Mir1Z99xT+R63jZxAT5lFZLa2inS5h+ZS2GvR99/FBg== + dependencies: + p-finally "^1.0.0" + p-try@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/p-try/-/p-try-1.0.0.tgz#cbc79cdbaf8fd4228e13f621f2b1a237c1b207b3" @@ -14216,6 +14258,11 @@ prepend-http@^2.0.0: resolved "https://registry.yarnpkg.com/prepend-http/-/prepend-http-2.0.0.tgz#e92434bfa5ea8c19f41cdfd401d741a3c819d897" integrity sha1-6SQ0v6XqjBn0HN/UAddBo8gZ2Jc= +prepend-http@^3.0.1: + version "3.0.1" + resolved "https://registry.yarnpkg.com/prepend-http/-/prepend-http-3.0.1.tgz#3e724d58fd5867465b300bb9615009fa2f8ee3b6" + integrity sha512-BLxfZh+m6UiAiCPZFJ4+vYoL7NrRs5XgCTRrjseATAggXhdZKKxn+JUNmuVYWY23bDHgaEHodxw8mnmtVEDtHw== + pretty-bytes@^5.3.0, pretty-bytes@^5.6.0: version "5.6.0" resolved "https://registry.yarnpkg.com/pretty-bytes/-/pretty-bytes-5.6.0.tgz#356256f643804773c82f64723fe78c92c62beaeb" @@ -15422,6 +15469,11 @@ rollup@^1.31.1: "@types/node" "*" acorn "^7.1.0" +router-ips@^1.0.0: + version "1.0.0" + resolved "https://registry.yarnpkg.com/router-ips/-/router-ips-1.0.0.tgz#44e00858ebebc0133d58e40b2cd8a1fbb04203f5" + integrity sha512-yBo6F52Un/WYioXbedBGvrKIiofbwt+4cUhdqDb9fNMJBI4D4jOy7jlxxaRVEvICPKU7xMmJDtDFR6YswX/sFQ== + rsvp@^4.8.4: version "4.8.5" resolved "https://registry.yarnpkg.com/rsvp/-/rsvp-4.8.5.tgz#c8f155311d167f68f21e168df71ec5b083113734" @@ -17517,6 +17569,14 @@ url-parse@^1.4.3, url-parse@^1.5.3, url-parse@~1.5.1: querystringify "^2.1.1" requires-port "^1.0.0" +url-parse@^1.5.10: + version "1.5.10" + resolved "https://registry.yarnpkg.com/url-parse/-/url-parse-1.5.10.tgz#9d3c2f736c1d75dd3bd2be507dcc111f1e2ea9c1" + integrity sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ== + dependencies: + querystringify "^2.1.1" + requires-port "^1.0.0" + url-template@^2.0.8: version "2.0.8" resolved "https://registry.yarnpkg.com/url-template/-/url-template-2.0.8.tgz#fc565a3cccbff7730c775f5641f9555791439f21"