@webex/webex-core 3.12.0-auth-prejoin-fetch.1 → 3.12.0-llmrefactor.10

package/src/lib/services-v2/service-catalog.ts

@@ -4,6 +4,7 @@ import {union} from 'lodash';
 import ServiceDetail from './service-detail';
 import {IServiceDetail, ServiceGroup} from './types';
 import {matchAllowedDomain, normalizeAllowedDomains} from '../domains';
+import {matchesParsedCatalogUrl, parseCatalogUrl} from '../services/service-catalog';
 
 /**
  * @class
@@ -199,9 +200,17 @@ const ServiceCatalog = AmpState.extend({
   findServiceDetailFromUrl(url: string): IServiceDetail | undefined {
     const serviceDetails = this._getAllServiceDetails();
 
+    let candidateUrl: URL;
+
+    try {
+      candidateUrl = new URL(url);
+    } catch {
+      return undefined;
+    }
+
     return serviceDetails.find(({serviceUrls}) => {
       for (const serviceUrl of serviceUrls) {
-        if (url.startsWith(serviceUrl.baseUrl)) {
+        if (matchesParsedCatalogUrl(candidateUrl, parseCatalogUrl(serviceUrl.baseUrl))) {
           return true;
         }
       }

package/src/lib/services-v2/services-v2.ts

@@ -7,6 +7,7 @@ import METRICS from '../metrics';
 import ServiceCatalog from './service-catalog';
 import fedRampServices from './service-fed-ramp';
 import {COMMERCIAL_ALLOWED_DOMAINS} from '../constants';
+import {matchesCatalogUrl} from '../services/service-catalog';
 import {
   ActiveServices,
   IServiceCatalog,
@@ -15,6 +16,7 @@ import {
   ServiceHostmap,
   ServiceGroup,
   ServiceHost,
+  ServiceUrl,
   SelectionMeta,
 } from './types';
 
@@ -988,7 +990,9 @@ const Services = WebexPlugin.extend({
 
     const priorityUrl = service.get();
     const defaultUrl = new URL(
-      service.serviceUrls.find((serviceUrl) => url.startsWith(serviceUrl.baseUrl)).baseUrl
+      service.serviceUrls.find((serviceUrl: ServiceUrl) =>
+        matchesCatalogUrl(url, serviceUrl.baseUrl)
+      ).baseUrl
     ).href;
 
     return {

package/src/webex-core.js

@@ -17,6 +17,7 @@ import AmpState from 'ampersand-state';
 import uuid from 'uuid';
 
 import AuthInterceptor from './interceptors/auth';
+import CatalogUrlInterceptor from './interceptors/catalog-url';
 import NetworkTimingInterceptor from './interceptors/network-timing';
 import PayloadTransformerInterceptor from './interceptors/payload-transformer';
 import RedirectInterceptor from './interceptors/redirect';
@@ -58,6 +59,7 @@ const interceptors = {
   /* eslint-enable no-extra-parens */
   RequestTimingInterceptor: RequestTimingInterceptor.create,
   ServiceInterceptor: undefined,
+  CatalogUrlInterceptor: CatalogUrlInterceptor.create,
   UserAgentInterceptor: UserAgentInterceptor.create,
   ProxyInterceptor: ProxyInterceptor.create,
   WebexUserAgentInterceptor: WebexUserAgentInterceptor.create,
@@ -83,6 +85,7 @@ const preInterceptors = [
   'RequestEventInterceptor',
   'WebexTrackingIdInterceptor',
   'RateLimitInterceptor',
+  'CatalogUrlInterceptor',
 ];
 
 const postInterceptors = [
@@ -393,6 +396,11 @@ const WebexCore = AmpState.extend({
         return ints;
       }
 
+      // CatalogUrlInterceptor is opt-in via config.services.validateCatalogUrls
+      if (key === 'CatalogUrlInterceptor' && this.config.services?.validateCatalogUrls !== true) {
+        return ints;
+      }
+
       ints.push(Reflect.apply(interceptor, this, []));
 
       return ints;

package/test/unit/spec/credentials/credentials.js

@@ -7,7 +7,7 @@ import {assert} from '@webex/test-helper-chai';
 import sinon from 'sinon';
 import MockWebex from '@webex/test-helper-mock-webex';
 import {Credentials, Token, grantErrors} from '@webex/webex-core';
-import {inBrowser} from '@webex/common';
+import {inBrowser, base64} from '@webex/common';
 import FakeTimers from '@sinonjs/fake-timers';
 import {skipInBrowser} from '@webex/test-helper-mocha';
 import Logger from '@webex/plugin-logger';
@@ -506,6 +506,88 @@ describe('webex-core', () => {
         expect(() => credentials.extractOrgIdFromUserToken()).toThrow());
     });
 
+    describe('#extractUserIdFromToken()', () => {
+      let credentials;
+      let webex;
+
+      beforeEach(() => {
+        webex = new MockWebex();
+        credentials = new Credentials(undefined, {parent: webex});
+      });
+
+      const buildToken = (payload) =>
+        `header.${base64.toBase64Url(JSON.stringify(payload))}.signature`;
+
+      it('should return the cis_uuid from the provided token', () => {
+        const token = buildToken({cis_uuid: 'my-user-id'});
+
+        assert.equal(credentials.extractUserIdFromToken(token), 'my-user-id');
+      });
+
+      it('should throw if the token does not contain a cis_uuid', () => {
+        const token = buildToken({foo: 'bar'});
+
+        expect(() => credentials.extractUserIdFromToken(token)).toThrow(
+          'the provided token does not contain a user ID'
+        );
+      });
+
+      it('should throw when provided an unparseable token', () =>
+        expect(() => credentials.extractUserIdFromToken('not-a-valid-token')).toThrow());
+
+      it('should throw when no token is provided', () =>
+        expect(() => credentials.extractUserIdFromToken()).toThrow());
+    });
+
+    describe('#getUserId()', () => {
+      let credentials;
+      let webex;
+
+      const buildToken = (userId) =>
+        `header.${base64.toBase64Url(JSON.stringify({cis_uuid: userId}))}.signature`;
+
+      beforeEach(() => {
+        webex = new MockWebex();
+        credentials = new Credentials(undefined, {parent: webex});
+      });
+
+      it('should return the userId from the supertoken', () => {
+        credentials.supertoken = makeToken(webex, {
+          access_token: buildToken('supertoken-user-id'),
+        });
+
+        assert.equal(credentials.getUserId(), 'supertoken-user-id');
+      });
+
+      it('should fall back to a user token when the supertoken has no userId', () => {
+        credentials.supertoken = makeToken(webex, {access_token: 'AT'});
+        credentials.userTokens.add(
+          makeToken(webex, {access_token: buildToken('user-token-user-id'), scope: 'scope1'})
+        );
+
+        assert.equal(credentials.getUserId(), 'user-token-user-id');
+      });
+
+      it('should prefer the supertoken over the user tokens', () => {
+        credentials.supertoken = makeToken(webex, {
+          access_token: buildToken('supertoken-user-id'),
+        });
+        credentials.userTokens.add(
+          makeToken(webex, {access_token: buildToken('user-token-user-id'), scope: 'scope1'})
+        );
+
+        assert.equal(credentials.getUserId(), 'supertoken-user-id');
+      });
+
+      it('should throw if no available token contains a userId', () => {
+        credentials.supertoken = makeToken(webex, {access_token: 'AT'});
+
+        expect(() => credentials.getUserId()).toThrow(
+          'could not extract the user ID from any available token'
+        );
+      });
+    });
+
     describe('#initialize()', () => {
       it('turns a portal auth string into a configuration object', () => {
         const webex = new MockWebex();
@@ -630,6 +712,37 @@ describe('webex-core', () => {
       });
     });
 
+    describe('#getClientToken()', () => {
+      it('requests a client token without bypassing catalog URL validation', async () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+        const uri = 'https://idbroker.webex.com/idb/oauth2/v1/access_token';
+        const scope = 'spark:all';
+
+        webex.request.resolves({body: {access_token: 'AT', token_type: 'Bearer'}});
+
+        const token = await credentials.getClientToken({uri, scope});
+
+        assert.calledOnceWithExactly(webex.request, {
+          method: 'POST',
+          uri,
+          form: {
+            grant_type: 'client_credentials',
+            scope,
+            self_contained_token: true,
+          },
+          auth: {
+            user: 'fake',
+            pass: 'fake',
+            sendImmediately: true,
+          },
+          shouldRefreshAccessToken: false,
+        });
+        assert.instanceOf(token, Token);
+        assert.equal(token.access_token, 'AT');
+      });
+    });
+
     describe('#getUserToken()', () => {
       it('resolves with the supertoken if the supertoken matches the requested scopes', () => {
         const webex = new MockWebex();

package/test/unit/spec/interceptors/catalog-url.js

@@ -0,0 +1,224 @@
+/*!
+ * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.
+ */
+
+import chai from 'chai';
+import chaiAsPromised from 'chai-as-promised';
+import sinon from 'sinon';
+import {CatalogUrlInterceptor} from '@webex/webex-core';
+
+const {assert} = chai;
+
+chai.use(chaiAsPromised);
+sinon.assert.expose(chai.assert, {prefix: ''});
+
+describe('webex-core', () => {
+  describe('Interceptors', () => {
+    describe('CatalogUrlInterceptor', () => {
+      let interceptor;
+      let webex;
+
+      beforeEach(() => {
+        webex = {
+          config: {
+            services: {},
+          },
+          internal: {
+            services: {
+              getServiceFromUrl: sinon.stub(),
+            },
+          },
+          logger: {
+            warn: sinon.stub(),
+          },
+        };
+
+        interceptor = Reflect.apply(CatalogUrlInterceptor.create, webex, []);
+      });
+
+      describe('#onRequest()', () => {
+        it('allows catalog URLs', async () => {
+          const options = {uri: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+          webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+          const result = await interceptor.onRequest(options);
+
+          assert.deepEqual(result, options);
+          assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.uri);
+        });
+
+        it('blocks non-catalog URLs with error', async () => {
+          const options = {uri: 'https://evil.attacker.com/steal-data'};
+          webex.internal.services.getServiceFromUrl.returns(undefined);
+
+          await assert.isRejected(
+            interceptor.onRequest(options),
+            /Request blocked: URL not in service catalog/
+          );
+          assert.calledOnce(webex.internal.services.getServiceFromUrl);
+        });
+
+        describe('service parameter bypass', () => {
+          it('skips validation when service has not been resolved to a URL', async () => {
+            const options = {
+              service: 'conversation',
+              resource: '/messages',
+            };
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.getServiceFromUrl);
+          });
+
+          it('blocks a non-catalog URL when service is also present', async () => {
+            const options = {
+              service: 'conversation',
+              resource: '/messages',
+              uri: 'https://attacker.com/steal',
+              headers: {authorization: 'Bearer token'},
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.uri);
+          });
+        });
+
+        describe('url parameter support', () => {
+          it('validates options.url when options.uri is not present', async () => {
+            const options = {url: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.url);
+          });
+        });
+
+        describe('edge cases', () => {
+          it('allows request when no URL is present', async () => {
+            const options = {method: 'GET'};
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.getServiceFromUrl);
+          });
+
+          it('handles missing services plugin gracefully', async () => {
+            webex.internal = undefined;
+            const options = {uri: 'https://example.com/api'};
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+          });
+        });
+
+        describe('security scenarios', () => {
+          it('blocks Mercury-injected malicious URLs', async () => {
+            // This is the SSRF attack vector: Mercury event contains attacker URL
+            // that the flag plugin would POST to without validation
+            const options = {
+              method: 'POST',
+              uri: 'https://attacker-controlled.com/exfiltrate',
+              body: {sensitiveData: 'secrets'},
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+          });
+
+          it('allows legitimate activity service URLs', async () => {
+            const options = {
+              method: 'POST',
+              uri: 'https://conv-a.wbx2.com/conversation/api/v1/activities/12345',
+              body: {verb: 'flag'},
+            };
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+          });
+
+          it('blocks URLs with similar-looking hostnames', async () => {
+            // Attacker might try to use a URL that looks similar to a catalog URL
+            const options = {
+              uri: 'https://conv-a.wbx2.com.attacker.com/api',
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+          });
+        });
+
+        describe('allowedDomains support', () => {
+          beforeEach(() => {
+            // Add allowedDomains methods to mock
+            webex.internal.services.validateDomains = true;
+            webex.internal.services.hasAllowedDomains = sinon.stub();
+            webex.internal.services.isAllowedDomainUrl = sinon.stub();
+          });
+
+          it('allows URLs in allowedDomains when not in catalog', async () => {
+            const options = {uri: 'https://cdn.example.com/files/encrypted-attachment.bin'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(true);
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.calledOnceWithExactly(webex.internal.services.isAllowedDomainUrl, options.uri);
+          });
+
+          it('blocks URLs not in catalog and not in allowedDomains', async () => {
+            const options = {uri: 'https://attacker.com/steal'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(false);
+
+            await assert.isRejected(
+              interceptor.onRequest(options),
+              /Request blocked: URL not in service catalog or allowed domains/
+            );
+          });
+
+          it('blocks when validateDomains is false', async () => {
+            const options = {uri: 'https://cdn.example.com/files/attachment.bin'};
+            webex.internal.services.validateDomains = false;
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(true);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+
+          it('blocks when no allowedDomains configured', async () => {
+            const options = {uri: 'https://cdn.example.com/files/attachment.bin'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(false);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+
+          it('skips allowedDomains check when URL is in catalog', async () => {
+            const options = {uri: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.hasAllowedDomains);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+        });
+      });
+    });
+  });
+});

package/test/unit/spec/interceptors/payload-transformer.js

@@ -4,7 +4,8 @@
 
 import {assert} from '@webex/test-helper-chai';
 import {capitalize} from 'lodash';
-import WebexCore from '@webex/webex-core';
+import sinon from 'sinon';
+import WebexCore, {PayloadTransformerInterceptor} from '@webex/webex-core';
 // TODO:  fix circular dependency core->metrics->core https://jira-eng-gpk2.cisco.com/jira/browse/SPARK-515520
 require('@webex/internal-plugin-metrics');
 
@@ -153,5 +154,122 @@ describe('webex-core', () => {
             ));
       });
     });
+
+    describe('PayloadTransformerInterceptor repeated inbound transforms', () => {
+      const createInterceptor = (skipRepeatedInboundTransforms) => {
+        const transform = sinon.stub().callsFake((direction, value) => Promise.resolve(value));
+        const interceptor = new PayloadTransformerInterceptor({
+          webex: {
+            config: {payloadTransformer: {skipRepeatedInboundTransforms}},
+            transform,
+          },
+        });
+
+        return {interceptor, transform};
+      };
+
+      describe('#onResponse()', () => {
+        it('transforms the same response every time when skipping repeated transforms is disabled', async () => {
+          const {interceptor, transform} = createInterceptor(false);
+          const response = {};
+
+          await interceptor.onResponse({}, response);
+          await interceptor.onResponse({}, response);
+
+          assert.calledTwice(transform);
+        });
+
+        it('transforms the same response only once when repeated transforms are skipped', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const response = {};
+
+          assert.equal(await interceptor.onResponse({}, response), response);
+          assert.equal(await interceptor.onResponse({}, response), response);
+          assert.calledOnceWithExactly(transform, 'inbound', response);
+        });
+
+        it('shares an in-flight transform for concurrent calls with the same response', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const response = {};
+          let resolveTransform;
+
+          transform.callsFake(
+            (direction, value) =>
+              new Promise((resolve) => {
+                resolveTransform = () => resolve(value);
+              })
+          );
+
+          const firstTransform = interceptor.onResponse({}, response);
+          const secondTransform = interceptor.onResponse({}, response);
+
+          assert.equal(firstTransform, secondTransform);
+          assert.calledOnceWithExactly(transform, 'inbound', response);
+
+          resolveTransform();
+
+          assert.equal(await firstTransform, response);
+          assert.equal(await secondTransform, response);
+        });
+
+        it('transforms distinct response objects independently', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const firstResponse = {};
+          const secondResponse = {};
+
+          await interceptor.onResponse({}, firstResponse);
+          await interceptor.onResponse({}, secondResponse);
+
+          assert.calledTwice(transform);
+          assert.isTrue(transform.firstCall.calledWithExactly('inbound', firstResponse));
+          assert.isTrue(transform.secondCall.calledWithExactly('inbound', secondResponse));
+        });
+
+        it('retries transformation after a failed transform', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const response = {};
+
+          transform.onFirstCall().rejects(new Error('transform failed'));
+
+          await assert.isRejected(interceptor.onResponse({}, response), 'transform failed');
+          assert.equal(await interceptor.onResponse({}, response), response);
+          assert.calledTwice(transform);
+        });
+
+        it('stores transform state as non-enumerable response metadata', async () => {
+          const {interceptor} = createInterceptor(true);
+          const response = {body: {value: true}};
+
+          await interceptor.onResponse({}, response);
+
+          const [marker] = Object.getOwnPropertySymbols(response);
+
+          assert.isDefined(marker);
+          assert.isFalse(Object.getOwnPropertyDescriptor(response, marker).enumerable);
+          assert.deepEqual(JSON.parse(JSON.stringify(response)), {body: {value: true}});
+        });
+
+        it('does not mark a response when transforms are disabled for that request', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const response = {};
+
+          assert.equal(await interceptor.onResponse({disableTransform: true}, response), response);
+          assert.equal(await interceptor.onResponse({}, response), response);
+          assert.calledOnceWithExactly(transform, 'inbound', response);
+        });
+      });
+
+      describe('#onResponseError()', () => {
+        it('continues transforming repeated error objects independently', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const reason = new Error('request failed');
+
+          await assert.isRejected(interceptor.onResponseError({}, reason), 'request failed');
+          await assert.isRejected(interceptor.onResponseError({}, reason), 'request failed');
+          assert.calledTwice(transform);
+          assert.alwaysCalledWithExactly(transform, 'inbound', reason);
+        });
+      });
+    });
   });
 });