clue-api 1.7.0.dev464__tar.gz → 1.7.0.dev465__tar.gz

{clue_api-1.7.0.dev464 → clue_api-1.7.0.dev465}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: clue-api
-Version: 1.7.0.dev464
+Version: 1.7.0.dev465
 Summary: Clue distributed enrichment service
 License: MIT
 License-File: LICENSE

{clue_api-1.7.0.dev464 → clue_api-1.7.0.dev465}/clue/api/v1/auth.py

@@ -1,5 +1,5 @@
 from typing import Any, Optional
-from urllib.parse import urlparse
+from urllib.parse import urlencode
 
 from authlib.integrations.base_client import OAuthError
 from flask import current_app, request
@@ -121,10 +121,11 @@ def login(**_) -> dict[str, Any]:  # noqa: C901
 
             # This means that they want to start the oauth process, so we'll redirect them to their chosen provider
             if "code" not in request.args and not refresh_token:
-                referer = request.headers.get("Referer", None)
-                uri = urlparse(referer if referer else request.host_url)
-                port_portion = ":" + str(uri.port) if uri.port else ""
-                redirect_uri = f"{uri.scheme}://{uri.hostname}{port_portion}/login?provider={oauth_provider}"
+                # The redirect URI must only come from trusted configuration, never from request headers
+                if not config.api.frontend_url:
+                    raise ClueValueError("api.frontend_url not set! Cannot start OAuth")
+
+                redirect_uri = f"{config.api.frontend_url.rstrip('/')}/login?{urlencode({'provider': oauth_provider})}"
                 return provider.authorize_redirect(redirect_uri=redirect_uri, nonce=request.args.get("nonce", None))
 
             # At this point we know the code exists, so we're good to use that to exchange for an JSON Web Token with

{clue_api-1.7.0.dev464 → clue_api-1.7.0.dev465}/clue/models/config.py

@@ -543,6 +543,10 @@ class API(BaseModel):
     audit: bool = Field(description="Should API calls be audited and saved to a separate log file?", default=True)
     debug: bool = Field(description="Enable debugging?", default=False)
     discover_url: str | None = Field(description="Discover URL", default=None)
+    frontend_url: str | None = Field(
+        description="Trusted Clue UI origin used to build the OAuth redirect URI. Required when OAuth is enabled.",
+        default=None,
+    )
     external_sources: list[ExternalSource] = Field(description="List of external sources to query", default=[])
     registration_allowed_origins: list[str] = Field(
         description="Exact URL origins permitted for runtime external source registration", default=[]
@@ -562,6 +566,67 @@ class API(BaseModel):
         description="Validate if the XSRF token matches the randomly generated token for the session", default=True
     )
 
+    @field_validator("frontend_url")
+    @classmethod
+    def validate_frontend_url(cls, frontend_url: str | None) -> str | None:  # noqa: ANN102
+        """Validates that frontend_url is a plain http(s) origin, and normalizes it to ``scheme://host[:port]``.
+
+        The UI is served from the root of its origin (no router basename, absolute /api and /login paths), so a
+        path other than an optional trailing slash is rejected.
+
+        Args:
+            frontend_url (str | None): The configured UI origin.
+
+        Raises:
+            ValueError: Raised whenever the URL is not a safe, unambiguous http(s) origin.
+
+        Returns:
+            str | None: The validated origin, without a trailing slash.
+        """
+        if frontend_url is None:
+            return None
+
+        error = (
+            "frontend_url must be an http(s) origin such as https://clue.example[:port] (an optional trailing slash "
+            "is allowed) with a valid ASCII host, and no credentials, path, query, fragment or percent-encoding"
+        )
+
+        # urlsplit silently drops tabs/newlines, so check the raw string first
+        if any(not char.isprintable() or char.isspace() or ord(char) > 126 or char in "\\%" for char in frontend_url):
+            raise ValueError(error)
+
+        try:
+            parsed = urlsplit(frontend_url)
+            port = parsed.port
+            host = parsed.hostname
+        except ValueError as err:
+            raise ValueError(error) from err
+
+        if (
+            parsed.scheme not in {"http", "https"}
+            or not host
+            or "@" in parsed.netloc
+            or parsed.netloc.endswith(":")
+            or (port is not None and port < 1)
+            or parsed.path not in {"", "/"}
+            or parsed.query
+            or parsed.fragment
+            or "?" in frontend_url
+            or "#" in frontend_url
+        ):
+            raise ValueError(error)
+
+        TypeAdapter(HttpUrl).validate_python(frontend_url)
+
+        # Prevent Pydantic from accepting invalid domains such as clue..com
+        if ":" not in host:
+            if any(char not in "abcdefghijklmnopqrstuvwxyz0123456789_-." for char in host) or any(
+                not label or label.startswith("-") or label.endswith("-") for label in host.split(".")
+            ):
+                raise ValueError(error)
+
+        return f"{parsed.scheme}://{parsed.netloc}"
+
 
 class Retention(BaseModel):
     enabled: Annotated[bool, Field(description="Should records be cached for users?")] = True
@@ -622,6 +687,14 @@ class Config(BaseSettings):
         env_nested_delimiter="__",
     )
 
+    @model_validator(mode="after")
+    def validate_oauth_frontend_url(self: Self) -> Self:
+        """The OAuth redirect URI is built from api.frontend_url, so it must be set when OAuth is enabled."""
+        if self.auth.oauth.enabled and not self.api.frontend_url:
+            raise ValueError("api.frontend_url must be set when auth.oauth.enabled is true")
+
+        return self
+
     @classmethod
     def settings_customise_sources(
         cls,  # noqa: ANN102

{clue_api-1.7.0.dev464 → clue_api-1.7.0.dev465}/pyproject.toml

@@ -141,7 +141,7 @@ log_cli_level = "WARN"
 [tool.poetry]
 package-mode = true
 name = "clue-api"
-version = "1.7.0.dev464"
+version = "1.7.0.dev465"
 description = "Clue distributed enrichment service"
 authors = ["Canadian Centre for Cyber Security <contact@cyber.gc.ca>"]
 license = "MIT"