@webex/webex-core 3.12.0-next.44 → 3.12.0-next.46

package/test/unit/spec/credentials/credentials.js

@@ -7,7 +7,7 @@ import {assert} from '@webex/test-helper-chai';
 import sinon from 'sinon';
 import MockWebex from '@webex/test-helper-mock-webex';
 import {Credentials, Token, grantErrors} from '@webex/webex-core';
-import {inBrowser} from '@webex/common';
+import {inBrowser, base64} from '@webex/common';
 import FakeTimers from '@sinonjs/fake-timers';
 import {skipInBrowser} from '@webex/test-helper-mocha';
 import Logger from '@webex/plugin-logger';
@@ -506,6 +506,88 @@ describe('webex-core', () => {
         expect(() => credentials.extractOrgIdFromUserToken()).toThrow());
     });
 
+    describe('#extractUserIdFromToken()', () => {
+      let credentials;
+      let webex;
+
+      beforeEach(() => {
+        webex = new MockWebex();
+        credentials = new Credentials(undefined, {parent: webex});
+      });
+
+      const buildToken = (payload) =>
+        `header.${base64.toBase64Url(JSON.stringify(payload))}.signature`;
+
+      it('should return the cis_uuid from the provided token', () => {
+        const token = buildToken({cis_uuid: 'my-user-id'});
+
+        assert.equal(credentials.extractUserIdFromToken(token), 'my-user-id');
+      });
+
+      it('should throw if the token does not contain a cis_uuid', () => {
+        const token = buildToken({foo: 'bar'});
+
+        expect(() => credentials.extractUserIdFromToken(token)).toThrow(
+          'the provided token does not contain a user ID'
+        );
+      });
+
+      it('should throw when provided an unparseable token', () =>
+        expect(() => credentials.extractUserIdFromToken('not-a-valid-token')).toThrow());
+
+      it('should throw when no token is provided', () =>
+        expect(() => credentials.extractUserIdFromToken()).toThrow());
+    });
+
+    describe('#getUserId()', () => {
+      let credentials;
+      let webex;
+
+      const buildToken = (userId) =>
+        `header.${base64.toBase64Url(JSON.stringify({cis_uuid: userId}))}.signature`;
+
+      beforeEach(() => {
+        webex = new MockWebex();
+        credentials = new Credentials(undefined, {parent: webex});
+      });
+
+      it('should return the userId from the supertoken', () => {
+        credentials.supertoken = makeToken(webex, {
+          access_token: buildToken('supertoken-user-id'),
+        });
+
+        assert.equal(credentials.getUserId(), 'supertoken-user-id');
+      });
+
+      it('should fall back to a user token when the supertoken has no userId', () => {
+        credentials.supertoken = makeToken(webex, {access_token: 'AT'});
+        credentials.userTokens.add(
+          makeToken(webex, {access_token: buildToken('user-token-user-id'), scope: 'scope1'})
+        );
+
+        assert.equal(credentials.getUserId(), 'user-token-user-id');
+      });
+
+      it('should prefer the supertoken over the user tokens', () => {
+        credentials.supertoken = makeToken(webex, {
+          access_token: buildToken('supertoken-user-id'),
+        });
+        credentials.userTokens.add(
+          makeToken(webex, {access_token: buildToken('user-token-user-id'), scope: 'scope1'})
+        );
+
+        assert.equal(credentials.getUserId(), 'supertoken-user-id');
+      });
+
+      it('should throw if no available token contains a userId', () => {
+        credentials.supertoken = makeToken(webex, {access_token: 'AT'});
+
+        expect(() => credentials.getUserId()).toThrow(
+          'could not extract the user ID from any available token'
+        );
+      });
+    });
+
     describe('#initialize()', () => {
       it('turns a portal auth string into a configuration object', () => {
         const webex = new MockWebex();
@@ -630,6 +712,37 @@ describe('webex-core', () => {
       });
     });
 
+    describe('#getClientToken()', () => {
+      it('requests a client token without bypassing catalog URL validation', async () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+        const uri = 'https://idbroker.webex.com/idb/oauth2/v1/access_token';
+        const scope = 'spark:all';
+
+        webex.request.resolves({body: {access_token: 'AT', token_type: 'Bearer'}});
+
+        const token = await credentials.getClientToken({uri, scope});
+
+        assert.calledOnceWithExactly(webex.request, {
+          method: 'POST',
+          uri,
+          form: {
+            grant_type: 'client_credentials',
+            scope,
+            self_contained_token: true,
+          },
+          auth: {
+            user: 'fake',
+            pass: 'fake',
+            sendImmediately: true,
+          },
+          shouldRefreshAccessToken: false,
+        });
+        assert.instanceOf(token, Token);
+        assert.equal(token.access_token, 'AT');
+      });
+    });
+
     describe('#getUserToken()', () => {
       it('resolves with the supertoken if the supertoken matches the requested scopes', () => {
         const webex = new MockWebex();

package/test/unit/spec/interceptors/catalog-url.js

@@ -0,0 +1,224 @@
+/*!
+ * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.
+ */
+
+import chai from 'chai';
+import chaiAsPromised from 'chai-as-promised';
+import sinon from 'sinon';
+import {CatalogUrlInterceptor} from '@webex/webex-core';
+
+const {assert} = chai;
+
+chai.use(chaiAsPromised);
+sinon.assert.expose(chai.assert, {prefix: ''});
+
+describe('webex-core', () => {
+  describe('Interceptors', () => {
+    describe('CatalogUrlInterceptor', () => {
+      let interceptor;
+      let webex;
+
+      beforeEach(() => {
+        webex = {
+          config: {
+            services: {},
+          },
+          internal: {
+            services: {
+              getServiceFromUrl: sinon.stub(),
+            },
+          },
+          logger: {
+            warn: sinon.stub(),
+          },
+        };
+
+        interceptor = Reflect.apply(CatalogUrlInterceptor.create, webex, []);
+      });
+
+      describe('#onRequest()', () => {
+        it('allows catalog URLs', async () => {
+          const options = {uri: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+          webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+          const result = await interceptor.onRequest(options);
+
+          assert.deepEqual(result, options);
+          assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.uri);
+        });
+
+        it('blocks non-catalog URLs with error', async () => {
+          const options = {uri: 'https://evil.attacker.com/steal-data'};
+          webex.internal.services.getServiceFromUrl.returns(undefined);
+
+          await assert.isRejected(
+            interceptor.onRequest(options),
+            /Request blocked: URL not in service catalog/
+          );
+          assert.calledOnce(webex.internal.services.getServiceFromUrl);
+        });
+
+        describe('service parameter bypass', () => {
+          it('skips validation when service has not been resolved to a URL', async () => {
+            const options = {
+              service: 'conversation',
+              resource: '/messages',
+            };
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.getServiceFromUrl);
+          });
+
+          it('blocks a non-catalog URL when service is also present', async () => {
+            const options = {
+              service: 'conversation',
+              resource: '/messages',
+              uri: 'https://attacker.com/steal',
+              headers: {authorization: 'Bearer token'},
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.uri);
+          });
+        });
+
+        describe('url parameter support', () => {
+          it('validates options.url when options.uri is not present', async () => {
+            const options = {url: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.url);
+          });
+        });
+
+        describe('edge cases', () => {
+          it('allows request when no URL is present', async () => {
+            const options = {method: 'GET'};
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.getServiceFromUrl);
+          });
+
+          it('handles missing services plugin gracefully', async () => {
+            webex.internal = undefined;
+            const options = {uri: 'https://example.com/api'};
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+          });
+        });
+
+        describe('security scenarios', () => {
+          it('blocks Mercury-injected malicious URLs', async () => {
+            // This is the SSRF attack vector: Mercury event contains attacker URL
+            // that the flag plugin would POST to without validation
+            const options = {
+              method: 'POST',
+              uri: 'https://attacker-controlled.com/exfiltrate',
+              body: {sensitiveData: 'secrets'},
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+          });
+
+          it('allows legitimate activity service URLs', async () => {
+            const options = {
+              method: 'POST',
+              uri: 'https://conv-a.wbx2.com/conversation/api/v1/activities/12345',
+              body: {verb: 'flag'},
+            };
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+          });
+
+          it('blocks URLs with similar-looking hostnames', async () => {
+            // Attacker might try to use a URL that looks similar to a catalog URL
+            const options = {
+              uri: 'https://conv-a.wbx2.com.attacker.com/api',
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+          });
+        });
+
+        describe('allowedDomains support', () => {
+          beforeEach(() => {
+            // Add allowedDomains methods to mock
+            webex.internal.services.validateDomains = true;
+            webex.internal.services.hasAllowedDomains = sinon.stub();
+            webex.internal.services.isAllowedDomainUrl = sinon.stub();
+          });
+
+          it('allows URLs in allowedDomains when not in catalog', async () => {
+            const options = {uri: 'https://cdn.example.com/files/encrypted-attachment.bin'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(true);
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.calledOnceWithExactly(webex.internal.services.isAllowedDomainUrl, options.uri);
+          });
+
+          it('blocks URLs not in catalog and not in allowedDomains', async () => {
+            const options = {uri: 'https://attacker.com/steal'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(false);
+
+            await assert.isRejected(
+              interceptor.onRequest(options),
+              /Request blocked: URL not in service catalog or allowed domains/
+            );
+          });
+
+          it('blocks when validateDomains is false', async () => {
+            const options = {uri: 'https://cdn.example.com/files/attachment.bin'};
+            webex.internal.services.validateDomains = false;
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(true);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+
+          it('blocks when no allowedDomains configured', async () => {
+            const options = {uri: 'https://cdn.example.com/files/attachment.bin'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(false);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+
+          it('skips allowedDomains check when URL is in catalog', async () => {
+            const options = {uri: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.hasAllowedDomains);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+        });
+      });
+    });
+  });
+});

package/test/unit/spec/services/service-catalog.js

@@ -5,6 +5,94 @@
 import {assert} from '@webex/test-helper-chai';
 import MockWebex from '@webex/test-helper-mock-webex';
 import {Services} from '@webex/webex-core';
+import {matchesCatalogUrl} from '../../../../src/lib/services/service-catalog';
+
+describe('matchesCatalogUrl()', () => {
+  describe('origin validation', () => {
+    it('returns true when origins match exactly', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when hosts differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://other.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when catalog host is prefix of candidate host (SECURITY)', () => {
+      // Attack: trusted.example.attacker.com should NOT match trusted.example
+      assert.isFalse(
+        matchesCatalogUrl(
+          'https://trusted.example.attacker.com/activities/id',
+          'https://trusted.example'
+        )
+      );
+    });
+
+    it('returns false when schemes differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('http://example.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when ports differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com:8443/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+  });
+
+  describe('path validation', () => {
+    it('returns true for root path catalog entry', () => {
+      assert.isTrue(matchesCatalogUrl('https://example.com/any/path/here', 'https://example.com/'));
+    });
+
+    it('returns true when paths match exactly', () => {
+      assert.isTrue(matchesCatalogUrl('https://example.com/api/v1', 'https://example.com/api/v1'));
+    });
+
+    it('returns true when candidate path extends catalog path at boundary', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users/123', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns true when catalog path has trailing slash', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users', 'https://example.com/api/v1/')
+      );
+    });
+
+    it('returns false when catalog path is prefix but not at path boundary (SECURITY)', () => {
+      // /api/v1 should NOT match /api/v1extra
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com/api/v1extra/something', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when candidate path does not start with catalog path', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com/other/path', 'https://example.com/api/v1')
+      );
+    });
+  });
+
+  describe('error handling', () => {
+    it('returns false for invalid candidate URL', () => {
+      assert.isFalse(matchesCatalogUrl('not-a-url', 'https://example.com/api'));
+    });
+
+    it('returns false for invalid catalog URL', () => {
+      assert.isFalse(matchesCatalogUrl('https://example.com/api', 'not-a-url'));
+    });
+
+    it('returns false when both URLs are invalid', () => {
+      assert.isFalse(matchesCatalogUrl('not-a-url', 'also-not-a-url'));
+    });
+  });
+});
 
 /* eslint-disable no-underscore-dangle */
 describe('webex-core', () => {
@@ -332,6 +420,109 @@ describe('webex-core', () => {
 
         assert.equal(service, exampleService);
       });
+
+      describe('security: origin validation', () => {
+        it('rejects URLs where the catalog host is a prefix of the candidate host (SECURITY)', () => {
+          // Attack: https://trusted.example.attacker.com should NOT match https://trusted.example
+          const exampleService = {
+            defaultUrl: 'https://trusted.example',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          // Attacker registers trusted.example.attacker.com
+          const attackerUrl = 'https://trusted.example.attacker.com/activities/id';
+          const service = catalog.findServiceUrlFromUrl(attackerUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs with different ports even if host matches', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const differentPortUrl = 'https://example.com:8443/resource/id';
+          const service = catalog.findServiceUrlFromUrl(differentPortUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs with different schemes', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const httpUrl = 'http://example.com/resource/id';
+          const service = catalog.findServiceUrlFromUrl(httpUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs where catalog path is a prefix but not at path boundary', () => {
+          // /api/v1 should NOT match /api/v1extra
+          const exampleService = {
+            defaultUrl: 'https://example.com/api/v1',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const nonBoundaryUrl = 'https://example.com/api/v1extra/something';
+          const service = catalog.findServiceUrlFromUrl(nonBoundaryUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('accepts URLs at exact path boundary', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/api/v1',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const boundaryUrl = 'https://example.com/api/v1/users/123';
+          const service = catalog.findServiceUrlFromUrl(boundaryUrl);
+
+          assert.equal(service, exampleService);
+        });
+
+        it('returns undefined for invalid URLs', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const invalidUrl = 'not-a-valid-url';
+          const service = catalog.findServiceUrlFromUrl(invalidUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('matches root path catalog entries correctly', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const subpathUrl = 'https://example.com/any/path/here';
+          const service = catalog.findServiceUrlFromUrl(subpathUrl);
+
+          assert.equal(service, exampleService);
+        });
+      });
     });
   });
 });

package/test/unit/spec/services-v2/service-catalog.ts

@@ -365,6 +365,37 @@ describe('webex-core', () => {
           assert.equal(service, exampleService);
         }
       );
+
+      it('rejects URLs with similar-looking hostnames (SECURITY)', () => {
+        // Attacker URL that looks like a catalog URL but has a different origin
+        const maliciousUrl = 'https://example.com.attacker.com/resource/id';
+
+        const exampleService = {
+          serviceUrls: [{baseUrl: 'https://example.com/resource'}],
+        };
+
+        catalog.serviceGroups.postauth.push(exampleService);
+
+        const service = catalog.findServiceDetailFromUrl(maliciousUrl);
+
+        // Should NOT match - origins are different
+        assert.isUndefined(service);
+      });
+
+      it('rejects URLs where catalog URL is a prefix but not at path boundary', () => {
+        // e.g., /api/v1 should not match /api/v1extra
+        const url = 'https://example.com/resourceextra/id';
+
+        const exampleService = {
+          serviceUrls: [{baseUrl: 'https://example.com/resource'}],
+        };
+
+        catalog.serviceGroups.postauth.push(exampleService);
+
+        const service = catalog.findServiceDetailFromUrl(url);
+
+        assert.isUndefined(service);
+      });
     });
   });
 });

package/test/unit/spec/services-v2/services-v2.ts

@@ -896,6 +896,26 @@ describe('webex-core', () => {
       });
     });
 
+    describe('#getServiceFromUrl()', () => {
+      it('matches an exact service URL when the catalog URL has a trailing slash', () => {
+        const baseUrl = 'https://example.com/api/v1/';
+
+        catalog.updateServiceGroups('preauth', [
+          {
+            id: 'example',
+            serviceName: 'example',
+            serviceUrls: [{host: 'example.com', baseUrl, priority: 1}],
+          },
+        ]);
+
+        assert.deepEqual(services.getServiceFromUrl('https://example.com/api/v1'), {
+          name: 'example',
+          priorityUrl: baseUrl,
+          defaultUrl: baseUrl,
+        });
+      });
+    });
+
     describe('#_formatReceivedHostmap()', () => {
       let serviceHostmap;
       let formattedHM;