improvement(gateway): introduce safeJWTSchema for identity token validation in gateway cmd deployment#5245
Conversation
- Added safeJWTSchema to enforce JWT format and prevent command injection. - Updated GatewayCliDeploymentMethod and GatewayCliSystemdDeploymentMethod to use safeJWTSchema for identityToken validation.
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Greptile OverviewGreptile SummaryAdded JWT token validation to prevent command injection in gateway deployment commands. The PR introduces Key changes:
Security impact: Note: Verify the regex pattern at the ReDoS checker per repository security guidelines (pattern appears safe with no nested quantifiers). Confidence Score: 4/5
Important Files Changed
|
scott-ray-wilson
left a comment
There was a problem hiding this comment.
LGTM, verified jwt regex in form
…Token validation - Replaced string validation for identityToken with safeJWTSchema in RelayCliDeploymentMethod, RelayCliSystemdDeploymentMethod, and RelayTerraformDeploymentMethod components. - Ensures consistent JWT format validation across deployment methods.
scott-ray-wilson
left a comment
There was a problem hiding this comment.
LGTM, verified relay as well
Context
We build the gateway deploy command using the provided machine identity token. But we don't validate the token value, allowing shell command injection like:
To prevent this, we added a regex validation on the token value to allow only characters that could be present in a JWT.
Steps to verify the change
Try adding cmd commands in the Deploy Gateway form and check if the validation is working.
Type
Checklist
type(scope): short description(scope is optional, e.g.,fix: prevent crash on syncorfix(api): handle null response).