Help finding the Entry Point in the code i.e. what is the first function that receives inboud HTTP Requests

[tdwyer]

Hello,

I'm starting a security audit of this code, but I'm having trouble finding the entry point.

I was expecting to find something equivalent to http.HandleFunc("/login", login). Then, I would read what func login() is doing, follow what functions it calls and read what they do, and so on. I need to find where the entry point is so I can follow the code flow to see what's being checked and how it's being checked so I can find mistakes/logical-errors/vulnerabilities.

Can, someone help me find the first function that handles and in-bound web-request e.g. when I make a POST request to /login what is the first function that handles it?

[aeneasr]

There is no such endpoint, the server generally boots here: https://github.com/ory/hydra/blob/master/cmd/server/handler.go

Enjoy :)

[tdwyer]

Well, unfortunately following that code path resulted in a dead end.

Along the way, I did find that the return n on Line 81 of cmd/server/handler.go will never be run and the if enabled { on Line 75 can be removed.

Here is work I was able to complete:

/* cmd/server/handler.go */

// 1
go serve(d, cmd, &wg,
  EnhanceMiddleware(d, publicmw, d.Config().PublicListenOn(), public.Router, false, "public"),
  d.Config().PublicListenOn(), d.Config().PublicSocketPermission(), cert,
)

d := driver.New(driver.WithOptions(configx.WithFlags(cmd.Flags())))
cmd *cobra.Command
wg = wg.Add(1)
handler = EnhanceMiddleware(d, publicmw, d.Config().PublicListenOn(), public.Router, false, "public")
address = d.Config().PublicListenOn()
permission = d.Config().PublicSocketPermission()
cert = GetOrCreateTLSCertificate(cmd, d)


// 2
func EnhanceMiddleware(d driver.Registry, n *negroni.Negroni, address string, router *httprouter.Router, enableCORS bool, iface string) http.Handler {

d := driver.New(driver.WithOptions(configx.WithFlags(cmd.Flags())))
n = publicmw // _, public, _, publicmw := setup(d, cmd)
address = d.Config().PublicListenOn()
router = public.Router
enableCORS = false
iface = "public"

/* TODO: Line 81 - return n will never be run */

n.UserHandler(router)
// If CORS = True
return cors.New(options).Handler(n)
// Else
return n


// 3
func setup(d driver.Registry, cmd *cobra.Command) (admin *x.RouterAdmin, public *x.RouterPublic, adminmw, publicmw *negroni.Negroni) {

d := driver.New(driver.WithOptions(configx.WithFlags(cmd.Flags())))
cmd *cobra.Command

// Returns
public = x.NewRouterPublic()
publicmw = negroni.New()


// 4
func serve(d driver.Registry, cmd *cobra.Command, wg *sync.WaitGroup, handler http.Handler, address string, permission *config.UnixPermission, cert []tls.Certificate) {


d := driver.New(driver.WithOptions(configx.WithFlags(cmd.Flags())))
cmd *cobra.Command
wg = wg.Add(1)
handler = EnhanceMiddleware(d, publicmw, d.Config().PublicListenOn(), public.Router, false, "public")
address = d.Config().PublicListenOn()
permission = d.Config().PublicSocketPermission()
cert = GetOrCreateTLSCertificate(cmd, d)

var srv = graceful.WithDefaults(&http.Server{
  Addr:    address,
  Handler: handler,
  // #nosec G402 - This is a false positive because we use graceful.WithDefaults which sets the correct TLS settings.
  TLSConfig: &tls.Config{
    Certificates: cert,
  },
})


/* "github.com/urfave/negroni" */

// 5

func New(handlers ...Handler) *Negroni {
	return &Negroni{
		handlers:   handlers,
		middleware: build(handlers),
	}
}

type Negroni struct {
	middleware middleware
	handlers   []Handler
}

handlers = // Hum... there is no input to handlers -- publicmw = negroni.New()

//
// NOTE: DEAD END -- There are no handlers defined
//

//
// NOTE: Following the Router becuase its the only thing I can do at this point
//

router = public = x.NewRouterPublic()

/* x/router.go */


func NewRouterPublic() *RouterPublic {
	router := httprouter.New()
	router.NotFound = serverx.DefaultNotFoundHandler
	return &RouterPublic{
		Router: router,
	}
}

func (r *RouterPublic) RouterAdmin() *RouterAdmin {
	return &RouterAdmin{Router: r.Router}
}

type RouterPublic struct {
	*httprouter.Router
}


/* "github.com/julienschmidt/httprouter" */

func New() *Router {
	return &Router{
		RedirectTrailingSlash:  true,
		RedirectFixedPath:      true,
		HandleMethodNotAllowed: true,
		HandleOPTIONS:          true,
	}
}

// ...[snip]...
	// An optional http.Handler that is called on automatic OPTIONS requests.
	// The handler is only called if HandleOPTIONS is true and no OPTIONS
	// handler for the specific path was set.
	// The "Allowed" header is set before calling the handler.
	GlobalOPTIONS http.Handler
// ...[snip]...

http.Handler = "net/http"


// NOTE: DEAD END -- there are no more code paths to follow

[tdwyer]

Looks like these are the files which map a Path e.g. /oauth2/auth to a Handler

consent/handler.go
client/handler.go
oauth2/handler.go
jwk/handler.go

Example:

func (h *Handler) SetRoutes(admin *x.RouterAdmin) {                                                           
        admin.GET(LoginPath, h.GetLoginRequest)                                              
        admin.PUT(LoginPath+"/accept", h.AcceptLoginRequest)                   
        admin.PUT(LoginPath+"/reject", h.RejectLoginRequest)                                               
        admin.GET(ConsentPath, h.GetConsentRequest)                                                                                                                                            
        admin.PUT(ConsentPath+"/accept", h.AcceptConsentRequest)                                                     
        admin.PUT(ConsentPath+"/reject", h.RejectConsentRequest)                                                                                                           
        admin.DELETE(SessionsPath+"/login", h.DeleteLoginSession)                                                    
        admin.GET(SessionsPath+"/consent", h.GetConsentSessions)                                                                             
        admin.DELETE(SessionsPath+"/consent", h.DeleteConsentSession)                                                                     
        admin.GET(LogoutPath, h.GetLogoutRequest)                                                                                         
        admin.PUT(LogoutPath+"/accept", h.AcceptLogoutRequest)                                                                
        admin.PUT(LogoutPath+"/reject", h.RejectLogoutRequest)                                                                                           
}