Fix RCE via unescaped OpenAPI path/header in Refit attributes (GHSA-3fhm-p725-h3g3) #1175
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
| using System.Linq; | ||
| using Microsoft.OpenApi; | ||
| using Microsoft.OpenApi.Reader; | ||
|
|
||
| namespace Refitter.Core.Validation; | ||
|
|
||
| /// <summary> | ||
| /// Rejects OpenAPI paths, header names, and content-type keys containing characters that could break | ||
| /// out of the generated Refit attribute string literals (e.g. quotes, backslashes, newlines). Generated | ||
| /// code escapes these characters, but rejecting them gives a clear error unless validation is skipped. | ||
| /// See GHSA-3fhm-p725-h3g3 (path), GHSA-58x9-vjvp-6mx8 (header name), GHSA-p32v-8v8j-j534 (content-type). | ||
| /// </summary> | ||
| internal static class AttributeStringValidator | ||
| { | ||
| internal static bool ContainsUnsafeCharacters(string? value) => | ||
| value != null && value.Any(c => c is '"' or '\\' || char.IsControl(c)); | ||
|
|
||
| internal static void Validate(OpenApiDocument? document, OpenApiDiagnostic diagnostic) | ||
|
Check failure on line 18 in src/Refitter.Core/Validation/AttributeStringValidator.cs
|
||
| { | ||
| if (document == null) | ||
| return; | ||
|
|
||
| // Validate security scheme names for API-key schemes with header location | ||
| if (document.Components?.SecuritySchemes != null) | ||
| { | ||
| foreach (var securityScheme in document.Components.SecuritySchemes) | ||
| { | ||
| if (securityScheme.Value?.Type == SecuritySchemeType.ApiKey | ||
| && securityScheme.Value.In == ParameterLocation.Header | ||
| && ContainsUnsafeCharacters(securityScheme.Value.Name)) | ||
| { | ||
| diagnostic.Errors.Add(new OpenApiError( | ||
| securityScheme.Key, | ||
| $"Security scheme '{securityScheme.Key}' has header name '{securityScheme.Value.Name}' containing illegal characters and is rejected to prevent code injection into Refit attributes. Use --skip-validation to bypass.")); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| if (document.Paths == null) | ||
| return; | ||
|
|
||
| // Accept/Content-Type headers are only emitted from content map keys for OpenAPI 3.0+, | ||
| // so only reject unsafe content-type keys for those documents to avoid Swagger 2.0 false positives. | ||
| var validateContentTypes = diagnostic.SpecificationVersion != OpenApiSpecVersion.OpenApi2_0; | ||
|
|
||
| foreach (var path in document.Paths) | ||
| { | ||
| if (ContainsUnsafeCharacters(path.Key)) | ||
| { | ||
| diagnostic.Errors.Add(new OpenApiError( | ||
| path.Key, | ||
| $"Path '{path.Key}' contains illegal characters (quotes, backslashes, or control characters) and is rejected to prevent code injection into Refit attributes. Use --skip-validation to bypass.")); | ||
| } | ||
|
|
||
| if (path.Value?.Operations == null) | ||
| continue; | ||
|
|
||
| foreach (var operation in path.Value.Operations.Values) | ||
| { | ||
| if (operation == null) | ||
| continue; | ||
|
|
||
| if (operation.Parameters != null) | ||
| { | ||
| foreach (var parameter in operation.Parameters) | ||
| { | ||
| if (parameter.In == ParameterLocation.Header && ContainsUnsafeCharacters(parameter.Name)) | ||
| { | ||
| diagnostic.Errors.Add(new OpenApiError( | ||
| parameter.Name ?? string.Empty, | ||
| $"Header parameter name '{parameter.Name}' contains illegal characters and is rejected to prevent code injection into Refit attributes. Use --skip-validation to bypass.")); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| if (validateContentTypes) | ||
| { | ||
| ValidateContentTypeKeys(operation, diagnostic); | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| private static void ValidateContentTypeKeys(OpenApiOperation operation, OpenApiDiagnostic diagnostic) | ||
| { | ||
| if (operation.RequestBody?.Content != null) | ||
| { | ||
| foreach (var contentType in operation.RequestBody.Content.Keys) | ||
| { | ||
| AddContentTypeErrorIfUnsafe(contentType, diagnostic); | ||
| } | ||
| } | ||
|
|
||
| if (operation.Responses == null) | ||
| return; | ||
|
|
||
| foreach (var response in operation.Responses.Values) | ||
| { | ||
| if (response?.Content == null) | ||
| continue; | ||
|
|
||
| foreach (var contentType in response.Content.Keys) | ||
| { | ||
| AddContentTypeErrorIfUnsafe(contentType, diagnostic); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| private static void AddContentTypeErrorIfUnsafe(string contentType, OpenApiDiagnostic diagnostic) | ||
| { | ||
| if (ContainsUnsafeCharacters(contentType)) | ||
| { | ||
| diagnostic.Errors.Add(new OpenApiError( | ||
| contentType, | ||
| $"Content type '{contentType}' contains illegal characters and is rejected to prevent code injection into Refit attributes. Use --skip-validation to bypass.")); | ||
| } | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.