Skip to content

Adding Check Against Injection Attacks #2619

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jan 11, 2024
Merged

Adding Check Against Injection Attacks #2619

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
54b18bd
Initial changes to check for injection attempts when reading assertio…
Dec 27, 2023
520edb9
Fix null de-reference warning
Dec 27, 2023
5e2d963
Correcting the null check condition
Dec 27, 2023
555b72a
Merge branch 'master' into francofung/Add_Check_Against_Injection_Attack
FuPingFranco Jan 10, 2024
17a38f2
Merge branch 'master' into francofung/Add_Check_Against_Injection_Attack
FuPingFranco Jan 11, 2024
29f3633
Added additional check to avoid NRE
Jan 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/Microsoft.Identity.Web.TokenAcquisition/IDWebErrorMessage.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,8 @@ internal static class IDWebErrorMessage
public const string MicrosoftIdentityWebChallengeUserException = "IDW10502: An MsalUiRequiredException was thrown due to a challenge for the user. " +
"See https://aka.ms/ms-id-web/ca_incremental-consent. ";
public const string ProvidedAuthenticationSchemeIsIncorrect = "IDW10503: Cannot determine the cloud Instance. The provided authentication scheme was '{0}'. Microsoft.Identity.Web inferred '{1}' as the authentication scheme. Available authentication schemes are '{2}'. See https://aka.ms/id-web/authSchemes. ";
public const string InvalidAssertion = "IDW10504: Invalid assertion: contains unsupported character(s).";
public const string InvalidSubAssertion = "IDW10505: Invalid sub_assertion: contains unsupported character(s).";

// Encoding IDW10600 = "IDW10600:"
public const string InvalidBase64UrlString = "IDW10601: Invalid Base64URL string. ";
Expand Down
18 changes: 18 additions & 0 deletions src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -783,6 +783,10 @@ private void NotifyCertificateSelection(MergedOptions mergedOptions, IConfidenti
// Special case when the OBO inbound token is composite (for instance PFT)
if (dict.ContainsKey(assertionConstant) && dict.ContainsKey(subAssertionConstant))
{

// Check assertion and sub_assertion passed from merging extra query parameters to ensure they do not contain unsupported character(s).
CheckAssertionsForInjectionAttempt(dict[assertionConstant], dict[subAssertionConstant]);

builder.OnBeforeTokenRequest((data) =>
{
// Replace the assertion and adds sub_assertion with the values from the extra query parameters
Expand Down Expand Up @@ -831,6 +835,20 @@ private void NotifyCertificateSelection(MergedOptions mergedOptions, IConfidenti
}
}

/// <summary>
/// Checks assertion and sub_assertion passed from merging extra query parameters to ensure they do not contain unsupported characters.
/// </summary>
/// <param name="assertion">The assertion.</param>
/// <param name="subAssertion">The sub_assertion.</param>
private static void CheckAssertionsForInjectionAttempt(string assertion, string subAssertion)
{
if (!assertion.IsNullOrEmpty() || !subAssertion.IsNullOrEmpty())
{
if (!assertion.IsNullOrEmpty() && assertion.Contains('&', StringComparison.InvariantCultureIgnoreCase)) throw new ArgumentException(IDWebErrorMessage.InvalidAssertion, nameof(assertion));
if (!subAssertion.IsNullOrEmpty() && (subAssertion.Contains('&', StringComparison.InvariantCultureIgnoreCase))) throw new ArgumentException(IDWebErrorMessage.InvalidSubAssertion, nameof(subAssertion));
}
}

private static string? GetActualToken(SecurityToken? validatedToken)
{
JwtSecurityToken? jwtSecurityToken = validatedToken as JwtSecurityToken;
Expand Down