gian/seaweedfs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(iam): reject empty issuer in ComputeParentUser (#9326)

Browse Source 
Without iss, the same `sub` from two different IDPs would collapse to
the same parent_user hash. Short-circuit to empty when either input
is missing so callers see "no identity" instead of a colliding hash.

Addresses coderabbit review on PR #9318.
This commit is contained in:
Chris Lu 2026-05-05 13:01:33 -07:00 committed by GitHub
parent 1d3454ca5c
commit bc1d458fe6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
weed/iam/sts/parent_user_test.go
View File

@ -43,6 +43,14 @@ func TestComputeParentUserEmptySub(t *testing.T) {
}
}
func TestComputeParentUserEmptyIss(t *testing.T) {
// Without an issuer, two different IDPs that both name a user "alice"
// would collide on the same parent_user. Refuse rather than hash.
if got := ComputeParentUser("alice", ""); got != "" {
t.Fatalf("empty iss should produce empty parent user, got %q", got)
}
}
func TestComputeParentUserEncoding(t *testing.T) {
got := ComputeParentUser("alice", "https://idp.example/")
// Base64 RawURL has no padding and uses URL-safe alphabet — important

2
weed/iam/sts/session_claims.go
View File

@ -17,7 +17,7 @@ import (
// id. The hash is base64-rawurl-encoded SHA-256 over "openid:<sub>:<iss>" so
// it stays filesystem-safe and bounded in length for storage in audit paths.
func ComputeParentUser(sub, iss string) string {
if sub == "" {
if sub == "" || iss == "" {
return ""
}
h := sha256.Sum256([]byte("openid:" + sub + ":" + iss))