81 lines
2.1 KiB
JavaScript
81 lines
2.1 KiB
JavaScript
// packages/backend/src/controller/implictGrant.ts
|
|
var ImplicitGrantController = class {
|
|
isImplicitGrantReq(req) {
|
|
const query = req.getQuery();
|
|
if (query.includes("client_id=") && query.includes("response_type=token")) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
isSendTokenToClient(req) {
|
|
const path = req.getPath();
|
|
const query = req.getQuery();
|
|
if (query.includes("access_token=") && query.includes("state=") || path.includes("&access_token=") || /access_token=%/i.test(query)) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
testReq(req) {
|
|
if (this.isImplicitGrantReq(req)) {
|
|
return "isImplicitGrantReq";
|
|
}
|
|
if (this.isSendTokenToClient(req)) {
|
|
return "isSendTokenToClient";
|
|
}
|
|
return false;
|
|
}
|
|
};
|
|
|
|
// packages/backend/src/controller/authZCodeGrant.ts
|
|
var AuthZCodeGrantController = class {
|
|
constructor() {
|
|
}
|
|
isAuthZReq(req) {
|
|
const query = req.getQuery();
|
|
if (query.includes("client_id=") && query.includes("response_type=code")) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
isSendCodeToClient(req) {
|
|
const path = req.getPath();
|
|
const query = req.getQuery();
|
|
if (query.includes("code=") && query.includes("state=") || path.includes("&code=") || /code=%/i.test(query)) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
testReq(req) {
|
|
if (this.isAuthZReq(req)) {
|
|
return "isAuthZReq";
|
|
}
|
|
if (this.isSendCodeToClient(req)) {
|
|
return "isSendCodeToClient";
|
|
}
|
|
return false;
|
|
}
|
|
// isAccessTokenReq(req: Response) {
|
|
// }
|
|
};
|
|
|
|
// packages/backend/src/index.ts
|
|
var implicitGrantController = new ImplicitGrantController();
|
|
var authZCodeGrantController = new AuthZCodeGrantController();
|
|
function init(sdk) {
|
|
sdk.events.onInterceptRequest(async (sdk2, req) => {
|
|
const result = authZCodeGrantController.testReq(req) || implicitGrantController.testReq(req);
|
|
if (result) {
|
|
await sdk2.findings.create({
|
|
title: "Possible SSO Request Detected",
|
|
description: `SSO-related parameters detected in request:
|
|
|
|
${req.getMethod()} ${req.getUrl()} : ${result}`,
|
|
request: req,
|
|
reporter: ""
|
|
});
|
|
}
|
|
});
|
|
}
|
|
export {
|
|
init
|
|
};
|