rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add compliange page base URL in context and use it to validate redirect URLs

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-03-03 16:39:13 +04:00
parent 823fc64c37
commit c4b06ddc7d
8 changed files with 58 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/server/api/trust/v1/graphql_handler.go
View File

@@ -21,7 +21,6 @@ import (
"go.probo.inc/probo/pkg/baseurl"
"go.probo.inc/probo/pkg/esign"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/saferedirect"
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/trust/v1/schema"
@@ -39,7 +38,6 @@ func NewGraphQLHandler(iamSvc *iam.Service, trustSvc *trust.Service, esignSvc *e
logger: logger,
baseURL: baseURL,
sessionCookie: authn.NewCookie(&cookieConfig),
safeRedirect: &saferedirect.SafeRedirect{AllowedHost: baseURL.Host()},
},
Directives: schema.DirectiveRoot{
Nda: newNDADirectiveFunc(logger, trustSvc, esignSvc),

2
pkg/server/api/trust/v1/resolver.go
View File

@@ -26,7 +26,6 @@ import (
"go.probo.inc/probo/pkg/esign"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/saferedirect"
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/compliancepage"
@@ -53,7 +52,6 @@ type (
iam *iam.Service
sessionCookie *authn.Cookie
baseURL *baseurl.BaseURL
safeRedirect *saferedirect.SafeRedirect
}
)

13
pkg/server/api/trust/v1/v1_resolver.go
View File

@@ -14,11 +14,13 @@ import (
"time"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/baseurl"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/esign"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/page"
"go.probo.inc/probo/pkg/saferedirect"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/compliancepage"
"go.probo.inc/probo/pkg/server/api/trust/v1/schema"
@@ -157,6 +159,17 @@ func (r *frameworkResolver) DarkLogoURL(ctx context.Context, obj *types.Framewor
func (r *mutationResolver) SendMagicLink(ctx context.Context, input types.SendMagicLinkInput) (*types.SendMagicLinkPayload, error) {
trustCenter := compliancepage.CompliancePageFromContext(ctx)
baseURL := compliancepage.CompliancePageBaseURLFromContext(ctx)
safeRedirect := &saferedirect.SafeRedirect{AllowedHost: baseurl.MustParse(*baseURL).Host()}
if input.Continue != nil {
_, ok := safeRedirect.Validate(*input.Continue)
if !ok {
return nil, gqlutils.Invalidf(ctx, "invalid continue URL")
}
}
req := &iam.SendMagicLinkRequest{
Email: input.Email,
CompliancePageID: &trustCenter.ID,