@strapi/plugin-users-permissions 5.52.3 → 5.53.0

package/server/src/graphql/mutations/auth/reset-password.js

@@ -3,9 +3,11 @@
 const { toPlainObject } = require('lodash/fp');
 
 const { checkBadRequest } = require('../../utils');
+const { createRateLimitRunner } = require('./rate-limit');
 
 module.exports = ({ nexus, strapi }) => {
   const { nonNull } = nexus;
+  const runRateLimit = createRateLimitRunner(strapi, '/auth/reset-password');
 
   return {
     type: 'UsersPermissionsLoginPayload',
@@ -21,11 +23,9 @@ module.exports = ({ nexus, strapi }) => {
     async resolve(parent, args, context) {
       const { koaContext } = context;
 
-      koaContext.request.body = toPlainObject(args);
-
-      await strapi.plugin('users-permissions').controller('auth').resetPassword(koaContext);
-
-      const output = koaContext.body;
+      const output = await runRateLimit(koaContext, { body: toPlainObject(args) }, (ctx) =>
+        strapi.plugin('users-permissions').controller('auth').resetPassword(ctx)
+      );
 
       checkBadRequest(output);
 

package/server/src/services/providers-registry.js

@@ -23,6 +23,9 @@ const initProviders = ({ baseURL }) => ({
     },
     async authCallback({ accessToken }) {
       const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);
+      if (body.verified !== true) {
+        throw new Error('Email not verified by Discord');
+      }
       const username =
         body.discriminator && body.discriminator !== '0'
           ? `${body.username}#${body.discriminator}`
@@ -46,6 +49,9 @@ const initProviders = ({ baseURL }) => ({
       const { body } = await bearerGet('https://graph.facebook.com/me', accessToken, {
         qs: { fields: 'name,email' },
       });
+      if (!body.email) {
+        throw new Error('Email not verified by Facebook');
+      }
       return {
         username: body.name,
         email: body.email,
@@ -65,6 +71,10 @@ const initProviders = ({ baseURL }) => ({
       const { body } = await fetchJson(
         `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`
       );
+      const verified = body.verified_email ?? body.email_verified;
+      if (verified !== true && verified !== 'true') {
+        throw new Error('Email not verified by Google');
+      }
       return {
         username: body.email.split('@')[0],
         email: body.email,
@@ -85,13 +95,6 @@ const initProviders = ({ baseURL }) => ({
         headers: { 'user-agent': 'strapi' },
       });
 
-      if (userBody.email) {
-        return {
-          username: userBody.login,
-          email: userBody.email,
-        };
-      }
-
       const { body: emailBody } = await bearerGet(
         'https://api.github.com/user/emails',
         accessToken,
@@ -100,11 +103,32 @@ const initProviders = ({ baseURL }) => ({
         }
       );
 
+      if (userBody.email) {
+        const verifiedPublicEmail = Array.isArray(emailBody)
+          ? emailBody.find((entry) => entry.email === userBody.email && entry.verified === true)
+          : null;
+
+        if (!verifiedPublicEmail) {
+          throw new Error('Email not verified by GitHub');
+        }
+
+        return {
+          username: userBody.login,
+          email: userBody.email,
+        };
+      }
+
+      const primaryEmail = Array.isArray(emailBody)
+        ? emailBody.find((email) => email.primary === true)
+        : null;
+
+      if (!primaryEmail || primaryEmail.verified !== true) {
+        throw new Error('Email not verified by GitHub');
+      }
+
       return {
         username: userBody.login,
-        email: Array.isArray(emailBody)
-          ? emailBody.find((email) => email.primary === true).email
-          : null,
+        email: primaryEmail.email,
       };
     },
   },
@@ -134,17 +158,28 @@ const initProviders = ({ baseURL }) => ({
       secret: '',
       callbackUrl: `${baseURL}/twitter/callback`,
     },
-    async authCallback({ accessToken, query, providers }) {
+    async authCallback({ accessToken, providers, grantResponse }) {
+      const accessSecret = grantResponse?.access_secret;
+      const screenName = grantResponse?.raw?.screen_name;
+
+      if (!accessSecret) {
+        throw new Error('Twitter authentication requires a completed OAuth session');
+      }
+
       const { twitterGet } = require('../utils/oauth-connect/oauth1');
       const { body } = await twitterGet({
         url: 'https://api.twitter.com/1.1/account/verify_credentials.json',
         accessToken,
-        accessCredential: query.access_secret,
+        accessCredential: accessSecret,
         consumerKey: providers.twitter.key,
         clientCredential: providers.twitter.secret,
-        qs: { include_email: 'true', screen_name: query['raw[screen_name]'] },
+        qs: { include_email: 'true', screen_name: screenName },
       });
 
+      if (!body.email) {
+        throw new Error('Email not verified by Twitter');
+      }
+
       return {
         username: body.screen_name,
         email: body.email,
@@ -179,13 +214,25 @@ const initProviders = ({ baseURL }) => ({
       callbackUrl: `${baseURL}/vk/callback`,
       scope: ['email'],
     },
-    async authCallback({ accessToken, query }) {
+    async authCallback({ accessToken, grantResponse }) {
+      const email = grantResponse?.raw?.email;
+      const userId = grantResponse?.raw?.user_id;
+
+      if (!email || !userId) {
+        throw new Error('VK authentication requires a completed OAuth session');
+      }
+
       const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {
-        qs: { user_ids: query.raw.user_id, v: '5.122' },
+        qs: { user_ids: userId, v: '5.122' },
       });
+
+      if (!body.response?.[0]) {
+        throw new Error('Invalid VK access token');
+      }
+
       return {
         username: `${body.response[0].last_name} ${body.response[0].first_name}`,
-        email: query.raw.email,
+        email,
       };
     },
   },
@@ -205,9 +252,13 @@ const initProviders = ({ baseURL }) => ({
           'Client-Id': providers.twitch.key,
         },
       });
+      const email = body.data?.[0]?.email;
+      if (!email) {
+        throw new Error('Email not verified by Twitch');
+      }
       return {
         username: body.data[0].login,
-        email: body.data[0].email,
+        email,
       };
     },
   },
@@ -228,7 +279,11 @@ const initProviders = ({ baseURL }) => ({
         accessToken
       );
 
-      const email = emailBody.elements[0]['handle~'];
+      const email = emailBody.elements[0]?.['handle~'];
+
+      if (!email?.emailAddress) {
+        throw new Error('Email not verified by LinkedIn');
+      }
 
       return {
         username: profileBody.localizedFirstName,
@@ -247,10 +302,18 @@ const initProviders = ({ baseURL }) => ({
       callback: `${baseURL}/cognito/callback`,
       scope: ['email', 'openid', 'profile'],
     },
-    async authCallback({ query, providers }) {
+    async authCallback({ providers, grantResponse }) {
       const jwksUrl = new URL(providers.cognito.jwksurl);
-      const idToken = query.id_token;
+      const idToken = grantResponse?.id_token;
+
+      if (!idToken) {
+        throw new Error('Cognito authentication requires a completed OAuth session');
+      }
+
       const tokenPayload = await verifyJwtWithJwks({ idToken, jwksUrl });
+      if (tokenPayload.email_verified !== true) {
+        throw new Error('Email not verified by Cognito');
+      }
       return {
         username: tokenPayload['cognito:username'],
         email: tokenPayload.email,
@@ -293,6 +356,9 @@ const initProviders = ({ baseURL }) => ({
         `https://${providers.auth0.subdomain}.auth0.com/userinfo`,
         accessToken
       );
+      if (body.email && body.email_verified !== true) {
+        throw new Error('Email not verified by Auth0');
+      }
       const username = body.username || body.nickname || body.name || body.email.split('@')[0];
       const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
 
@@ -324,11 +390,15 @@ const initProviders = ({ baseURL }) => ({
       const email = body.attributes
         ? body.attributes.strapiemail || body.attributes.email
         : body.strapiemail || body.email;
+      const emailVerified = body.email_verified ?? body.attributes?.email_verified;
       if (!username || !email) {
         strapi.log.warn(
           `CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`
         );
       }
+      if (email && emailVerified !== true) {
+        throw new Error('Email not verified by CAS');
+      }
       return {
         username,
         email,
@@ -347,10 +417,13 @@ const initProviders = ({ baseURL }) => ({
     },
     async authCallback({ accessToken }) {
       const { body } = await bearerGet(
-        'https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email',
+        'https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email,is_email_verified',
         accessToken
       );
       const patreonData = body.data.attributes;
+      if (patreonData.is_email_verified !== true) {
+        throw new Error('Email not verified by Patreon');
+      }
       return {
         username: patreonData.full_name,
         email: patreonData.email,
@@ -372,6 +445,9 @@ const initProviders = ({ baseURL }) => ({
         `https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`,
         accessToken
       );
+      if (body.email_verified !== true) {
+        throw new Error('Email not verified by Keycloak');
+      }
       return {
         username: body.preferred_username,
         email: body.email,
@@ -400,12 +476,12 @@ module.exports = () => {
       delete authProviders[name];
     },
 
-    async run({ provider, accessToken, query, providers }) {
+    async run({ provider, accessToken, query, providers, grantResponse }) {
       const authProvider = authProviders[provider];
 
       assert(authProvider, 'Unknown auth provider');
 
-      return authProvider.authCallback({ accessToken, query, providers });
+      return authProvider.authCallback({ accessToken, query, providers, grantResponse });
     },
   };
 };

package/server/src/services/providers.js

@@ -17,8 +17,8 @@ module.exports = ({ strapi }) => {
    * @param {String}   provider
    */
 
-  const getProfile = async (provider, query) => {
-    const accessToken = query.access_token || query.code || query.oauth_token;
+  const getProfile = async (provider, oauthData, { grantResponse } = {}) => {
+    const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;
 
     const providers = await strapi
       .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })
@@ -26,9 +26,10 @@ module.exports = ({ strapi }) => {
 
     return getService('providers-registry').run({
       provider,
-      query,
+      query: oauthData,
       accessToken,
       providers,
+      grantResponse,
     });
   };
 
@@ -42,15 +43,16 @@ module.exports = ({ strapi }) => {
    * @return  {*}
    */
 
-  const connect = async (provider, query) => {
-    const accessToken = query.access_token || query.code || query.oauth_token;
+  const connect = async (provider, oauthData, { grantResponse } = {}) => {
+    const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;
+    const idToken = oauthData.id_token;
 
-    if (!accessToken) {
+    if (!accessToken && !idToken) {
       throw new Error('No access_token.');
     }
 
     // Get the profile.
-    const profile = await getProfile(provider, query);
+    const profile = await getProfile(provider, oauthData, { grantResponse });
 
     const email = _.toLower(profile.email);
 

package/server/src/services/user.js

@@ -10,12 +10,14 @@ const crypto = require('crypto');
 const bcrypt = require('bcryptjs');
 const urlJoin = require('url-join');
 
-const { sanitize } = require('@strapi/utils');
-const { toNumber, getOr } = require('lodash/fp');
+const { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require('@strapi/utils');
+const { toNumber, getOr, pick } = require('lodash/fp');
 const { getService } = require('../utils');
 
 const USER_MODEL_UID = 'plugin::users-permissions.user';
 
+const pickAllowedQueryParams = pick(ALLOWED_QUERY_PARAM_KEYS);
+
 const getSessionManager = () => {
   const manager = strapi.sessionManager;
   return manager ?? null;
@@ -29,7 +31,11 @@ module.exports = ({ strapi }) => ({
    */
 
   count(params) {
-    return strapi.db.query(USER_MODEL_UID).count({ where: params });
+    const query = strapi
+      .get('query-params')
+      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
+
+    return strapi.db.query(USER_MODEL_UID).count(query);
   },
 
   /**
@@ -101,7 +107,9 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetch(id, params) {
-    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});
+    const query = strapi
+      .get('query-params')
+      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
 
     return strapi.db.query(USER_MODEL_UID).findOne({
       ...query,
@@ -124,7 +132,9 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetchAll(params) {
-    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});
+    const query = strapi
+      .get('query-params')
+      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
 
     return strapi.db.query(USER_MODEL_UID).findMany(query);
   },

package/server/src/utils/oauth-connect/index.js

@@ -5,6 +5,7 @@ const { errors } = require('@strapi/utils');
 const builtinProviderEndpoints = require('./providers');
 const oauth1 = require('./oauth1');
 const oauth2 = require('./oauth2');
+const { trimGrantSessionResponse } = require('../trim-grant-session-response');
 
 const CONNECT_PREFIX = '/connect';
 
@@ -87,6 +88,15 @@ const preserveGrantDynamic = (ctx) => {
   return dynamic ? { dynamic } : {};
 };
 
+const redirectWithSessionResponse = (ctx, callbackUrl, provider, tokenResponse) => {
+  const grantResponse = oauth2.tokensToQueryPayload(provider, tokenResponse);
+  ctx.session.grant = {
+    response: trimGrantSessionResponse(grantResponse, provider.name),
+  };
+
+  return redirectWithPayload(ctx, callbackUrl, {});
+};
+
 const startOAuth1Flow = async (ctx, provider, parsed, redirectUri) => {
   const requestToken = await oauth1.requestToken({
     requestUrl: provider.request_url,
@@ -142,9 +152,7 @@ const handleOAuth1Callback = async (ctx, provider, callbackUrl) => {
     oauthTokenCredential: requestToken.oauth_token_secret,
   });
 
-  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);
-  ctx.session.grant = {};
-  return redirectWithPayload(ctx, callbackUrl, payload);
+  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
 };
 
 const handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) => {
@@ -176,9 +184,7 @@ const handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) =>
     subdomain: provider.subdomain,
   });
 
-  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);
-  ctx.session.grant = {};
-  return redirectWithPayload(ctx, callbackUrl, payload);
+  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
 };
 
 const createOAuthConnectMiddleware = () => {

package/server/src/utils/trim-grant-session-response.js

@@ -0,0 +1,70 @@
+'use strict';
+
+const compact = (value) => {
+  if (value === null || value === undefined) {
+    return undefined;
+  }
+
+  if (typeof value !== 'object' || Array.isArray(value)) {
+    return value;
+  }
+
+  return Object.fromEntries(
+    Object.entries(value)
+      .map(([key, entry]) => [key, compact(entry)])
+      .filter(([, entry]) => entry !== undefined)
+  );
+};
+
+/**
+ * Compact grant's OAuth token response before it is written to the signed
+ * koa-session cookie. The full token exchange payload (especially Cognito's
+ * dual JWTs plus a duplicated raw blob) can exceed the browser's ~4 KB
+ * per-cookie limit and silently break the auth callback.
+ *
+ * Keep only fields that auth.callback / providers-registry actually read.
+ */
+const trimGrantSessionResponse = (grantResponse, provider) => {
+  if (!grantResponse || typeof grantResponse !== 'object') {
+    return grantResponse;
+  }
+
+  switch (provider) {
+    case 'cognito':
+      return compact({
+        id_token: grantResponse.id_token,
+      });
+
+    case 'twitter':
+      return compact({
+        access_token: grantResponse.access_token,
+        access_secret: grantResponse.access_secret,
+        raw: grantResponse.raw?.screen_name
+          ? { screen_name: grantResponse.raw.screen_name }
+          : undefined,
+      });
+
+    case 'vk':
+      return compact({
+        access_token: grantResponse.access_token,
+        raw:
+          grantResponse.raw?.email != null && grantResponse.raw?.user_id != null
+            ? {
+                email: grantResponse.raw.email,
+                user_id: grantResponse.raw.user_id,
+              }
+            : undefined,
+      });
+
+    default:
+      return compact({
+        access_token: grantResponse.access_token,
+        oauth_token: grantResponse.oauth_token,
+        id_token: grantResponse.id_token,
+      });
+  }
+};
+
+module.exports = {
+  trimGrantSessionResponse,
+};