feat: validate token format in both PHP and CLI

elibosley · elibosley · commit 6ef05a3d7770 · 2025-01-27T13:34:32.000-05:00
diff --git a/api/src/core/sso/sso-setup.ts b/api/src/core/sso/sso-setup.ts
@@ -23,8 +23,11 @@ function verifyUsernamePasswordAndSSO(string $username, string $password): bool
     // We may have an SSO token, attempt validation
     if (strlen($password) > 800) {
         $safePassword = escapeshellarg($password);
+        if (!preg_match('/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+$/', $password)) {
+            my_logger("SSO Login Attempt Failed: Invalid token format");
+        }
         $response = exec("/usr/local/bin/unraid-api sso validate-token $safePassword", $output, $code);
-        my_logger("SSO Login Response: $response");
+        my_logger("SSO Login Attempt: $response");
         if ($code === 0 && $response && strpos($response, '"valid":true') !== false) {
             return true;
         }
diff --git a/api/src/unraid-api/cli/sso/validate-token.command.ts b/api/src/unraid-api/cli/sso/validate-token.command.ts
@@ -38,10 +38,15 @@ export class ValidateTokenCommand extends CommandRunner {
         }
 
         const token = passedParams[0];
+
         if (typeof token !== 'string' || token.trim() === '') {
             this.createErrorAndExit('Invalid token provided');
         }
 
+        if (!/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+$/.test(token)) {
+            this.createErrorAndExit('Token format is invalid');
+        }
+
         let caughtError: null | unknown = null;
         let tokenPayload: null | JWTPayload = null;
         try {

Original file line number	Diff line number	Diff line change
`@@ -38,10 +38,15 @@ export class ValidateTokenCommand extends CommandRunner {`
`38`	`38`	`}`
`39`	`39`
`40`	`40`	`const token = passedParams[0];`
	`41`	`+`
`41`	`42`	`if (typeof token !== 'string' \|\| token.trim() === '') {`
`42`	`43`	`this.createErrorAndExit('Invalid token provided');`
`43`	`44`	`}`
`44`	`45`
	`46`	`+ if (!/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+$/.test(token)) {`
	`47`	`+ this.createErrorAndExit('Token format is invalid');`
	`48`	`+ }`
	`49`	`+`
`45`	`50`	`let caughtError: null \| unknown = null;`
`46`	`51`	`let tokenPayload: null \| JWTPayload = null;`
`47`	`52`	`try {`