| | | 1 | | using System.Net; |
| | | 2 | | using System.Net.Sockets; |
| | | 3 | | using System.Text.RegularExpressions; |
| | | 4 | | |
| | | 5 | | namespace Estud.Back.Extensions; |
| | | 6 | | |
| | | 7 | | public static partial class SsoExtensions |
| | | 8 | | { |
| | | 9 | | extension(string value) |
| | | 10 | | { |
| | | 11 | | public EstudError? ValidateSsoAuthority() |
| | | 12 | | { |
| | | 13 | | // Must be valid URI |
| | 28 | 14 | | if (!Uri.TryCreate(value, UriKind.Absolute, out var uri)) |
| | 0 | 15 | | return InvalidSsoAuthority.I; |
| | | 16 | | |
| | | 17 | | // Must be HTTPS |
| | 28 | 18 | | if (uri.Scheme != Uri.UriSchemeHttps) |
| | 4 | 19 | | return SsoAuthorityMustBeHttps.I; |
| | | 20 | | |
| | | 21 | | // Block URLs with userinfo (SSRF bypass: https://evil.com@169.254.169.254/) |
| | 24 | 22 | | if (uri.UserInfo.HasValue()) |
| | 4 | 23 | | return SsoAuthorityHasUserInfo.I; |
| | | 24 | | |
| | | 25 | | // Parse and validate the host |
| | 20 | 26 | | return uri.Host.ValidateSsoHost(); |
| | | 27 | | } |
| | | 28 | | |
| | | 29 | | public EstudError? ValidateSsoHost() |
| | | 30 | | { |
| | | 31 | | // Try to parse as IP address |
| | 20 | 32 | | if (IPAddress.TryParse(value, out var ip)) |
| | 4 | 33 | | return ip.ValidateSsoIpAddress(); |
| | | 34 | | |
| | | 35 | | // It's a hostname - check for dangerous hostnames |
| | 16 | 36 | | var lowerHost = value.ToLowerInvariant(); |
| | | 37 | | |
| | | 38 | | // Block localhost variants (allow in dev/testing) |
| | 16 | 39 | | if (lowerHost is "localhost" or "localhost.localdomain") |
| | 0 | 40 | | return EnvironmentExtensions.IsDevelopmentOrTesting() ? null : SsoAuthorityLocalhostNotAllowed.I; |
| | | 41 | | |
| | 16 | 42 | | return null; |
| | | 43 | | } |
| | | 44 | | |
| | | 45 | | public string? NormalizeSsoDomain() |
| | | 46 | | { |
| | 12 | 47 | | if (value.IsEmpty()) return null; |
| | | 48 | | |
| | 12 | 49 | | var normalized = value.Trim().ToLowerInvariant(); |
| | | 50 | | |
| | | 51 | | // Remove @ if present at start |
| | 12 | 52 | | if (normalized.StartsWith('@')) |
| | 0 | 53 | | normalized = normalized[1..]; |
| | | 54 | | |
| | | 55 | | // Basic domain validation |
| | 12 | 56 | | if (!SsoDomainRegex().IsMatch(normalized)) |
| | 0 | 57 | | return null; |
| | | 58 | | |
| | 12 | 59 | | return normalized; |
| | | 60 | | } |
| | | 61 | | } |
| | | 62 | | |
| | | 63 | | extension(IPAddress ip) |
| | | 64 | | { |
| | | 65 | | public EstudError? ValidateSsoIpAddress() |
| | | 66 | | { |
| | 4 | 67 | | var resolved = ip; |
| | 4 | 68 | | var isDevOrTest = EnvironmentExtensions.IsDevelopmentOrTesting(); |
| | | 69 | | |
| | | 70 | | // Handle IPv4-mapped IPv6 addresses (::ffff:127.0.0.1) |
| | 4 | 71 | | if (resolved.IsIPv4MappedToIPv6) |
| | 0 | 72 | | resolved = resolved.MapToIPv4(); |
| | | 73 | | |
| | | 74 | | // IPv6 checks |
| | 4 | 75 | | if (resolved.AddressFamily == AddressFamily.InterNetworkV6) |
| | | 76 | | { |
| | | 77 | | // Block IPv6 loopback (::1) — allow in dev/testing |
| | 0 | 78 | | if (IPAddress.IPv6Loopback.Equals(resolved)) |
| | 0 | 79 | | return isDevOrTest ? null : SsoAuthorityLoopbackNotAllowed.I; |
| | | 80 | | |
| | | 81 | | // Block IPv6 link-local (fe80::/10) — always blocked (cloud metadata risk) |
| | 0 | 82 | | if (resolved.IsIPv6LinkLocal) |
| | 0 | 83 | | return SsoAuthorityLinkLocalNotAllowed.I; |
| | | 84 | | |
| | | 85 | | // Block IPv6 unique local addresses (fc00::/7 = fc00:: and fd00::) — allow in dev/testing |
| | 0 | 86 | | var bytes = resolved.GetAddressBytes(); |
| | 0 | 87 | | if ((bytes[0] & 0xFE) == 0xFC) // fc00::/7 |
| | 0 | 88 | | return isDevOrTest ? null : SsoAuthorityPrivateIpNotAllowed.I; |
| | | 89 | | |
| | 0 | 90 | | return null; |
| | | 91 | | } |
| | | 92 | | |
| | | 93 | | // IPv4 checks |
| | 4 | 94 | | var ipBytes = resolved.GetAddressBytes(); |
| | | 95 | | |
| | | 96 | | // Block 0.0.0.0 — always blocked |
| | 4 | 97 | | if (ipBytes[0] == 0 && ipBytes[1] == 0 && ipBytes[2] == 0 && ipBytes[3] == 0) |
| | 0 | 98 | | return SsoAuthorityLoopbackNotAllowed.I; |
| | | 99 | | |
| | | 100 | | // Block entire loopback range 127.0.0.0/8 — allow in dev/testing |
| | 4 | 101 | | if (ipBytes[0] == 127) |
| | 0 | 102 | | return isDevOrTest ? null : SsoAuthorityLoopbackNotAllowed.I; |
| | | 103 | | |
| | | 104 | | // Block entire link-local range 169.254.0.0/16 — always blocked (cloud metadata risk) |
| | 4 | 105 | | if (ipBytes[0] == 169 && ipBytes[1] == 254) |
| | 4 | 106 | | return SsoAuthorityLinkLocalNotAllowed.I; |
| | | 107 | | |
| | | 108 | | // Block private IP ranges — allow in dev/testing |
| | 0 | 109 | | if (IsPrivateSsoIpV4(ipBytes)) |
| | 0 | 110 | | return isDevOrTest ? null : SsoAuthorityPrivateIpNotAllowed.I; |
| | | 111 | | |
| | 0 | 112 | | return null; |
| | | 113 | | } |
| | | 114 | | } |
| | | 115 | | |
| | | 116 | | private static bool IsPrivateSsoIpV4(byte[] bytes) |
| | | 117 | | { |
| | 0 | 118 | | return bytes[0] switch |
| | 0 | 119 | | { |
| | 0 | 120 | | 10 => true, // 10.0.0.0/8 |
| | 0 | 121 | | 172 => bytes[1] >= 16 && bytes[1] <= 31, // 172.16.0.0/12 |
| | 0 | 122 | | 192 => bytes[1] == 168, // 192.168.0.0/16 |
| | 0 | 123 | | _ => false |
| | 0 | 124 | | }; |
| | | 125 | | } |
| | | 126 | | |
| | | 127 | | [GeneratedRegex(@"^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$")] |
| | | 128 | | private static partial Regex SsoDomainRegex(); |
| | | 129 | | } |