Repository: owncloud/ocis
Pull request #4715 (2022-09-29 14:29:58)

Make tokeninfo endpoint unprotected
## Description
Make the tokeninfo endpoint unprotected as it is supposed to be available to the public.

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] Technical debt
- [ ] Tests only (no source changes)

JammingBen: Is is necessary to add the endpoint in the `proxy.yaml` files as well?

* tests/parallelDeployAcceptance/drone/ocis/proxy.yaml
* deployments/examples/oc10_ocis_parallel/config/ocis/proxy.yaml
* deployments/examples/ocis_individual_services/config/proxy/proxy.yaml
* deployments/examples/ocis_hello/config/ocis/proxy.yaml
sonarcloud[bot]: Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=4715)

[![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=BUG)  
[![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=VULNERABILITY)  
[![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=4715&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=4715&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=4715&resolved=false&types=SECURITY_HOTSPOT)  
[![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=CODE_SMELL)

[![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=4715&metric=coverage&view=list) No Coverage information  
[![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=4715&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=4715&metric=new_duplicated_lines_density&view=list)


C0rby: > Is is necessary to add the endpoint in the `proxy.yaml` files as well?
> 
>     * tests/parallelDeployAcceptance/drone/ocis/proxy.yaml
> 
>     * deployments/examples/oc10_ocis_parallel/config/ocis/proxy.yaml
> 
>     * deployments/examples/ocis_individual_services/config/proxy/proxy.yaml
> 
>     * deployments/examples/ocis_hello/config/ocis/proxy.yaml

Yeah, I think you need to add them there.
rhafer: Sorry for adding more confusion here :man_facepalming: , but I took a bit of a deeper look into the code now. I think the correct fix is to add `/ocs/v1.php/apps/files_sharing/api/v1/tokeninfo/unprotected` and `/ocs/v2.php/apps/files_sharing/api/v1/tokeninfo/unprotected` to the `_public_path` in the authentication middleware. That way that get should be handled by the `public_share_auth` middleware.

You can also remove `/remote.php/ocs/apps/files_sharing/api/v1/tokeninfo/unprotected` from that list, which I think is just wrong.

This way you shouldn't need to touch the defaultconfig.go, neither the docker-compose examples.

@C0rby Feel free to correct me if I am wrong.

C0rby: @rhafer is correct. This is the place where you need to add the lines: https://github.com/owncloud/ocis/blob/master/services/proxy/pkg/middleware/authentication.go#L24-L29

There is one already but it is prefixed with `/remote.php` which is wrong.
JammingBen: I've adjusted the PR, thx for your help!
sonarcloud[bot]: Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=4715)

[![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=BUG)  
[![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=VULNERABILITY)  
[![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=4715&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=4715&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=4715&resolved=false&types=SECURITY_HOTSPOT)  
[![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4715&resolved=false&types=CODE_SMELL)

[![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=4715&metric=coverage&view=list) No Coverage information  
[![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=4715&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=4715&metric=new_duplicated_lines_density&view=list)



Patch:
diff --git a/.drone.env b/.drone.env
index 417e22c6bc9..006991ef7af 100644
--- a/.drone.env
+++ b/.drone.env
@@ -1,5 +1,5 @@
 # The test runner source for API tests
-CORE_COMMITID=31529dcebe93e1d856d7034a8c0bbbde3b782390
+CORE_COMMITID=3027b2b8288211d3226ec03f308ff80b9322b10a
 CORE_BRANCH=master
 
 # The test runner source for UI tests
diff --git a/CHANGELOG.md b/CHANGELOG.md
index aa521c4f325..67df8b27741 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -164,6 +164,7 @@ The following sections list the changes for unreleased.
    TBD
 
    https://github.com/owncloud/ocis/pull/4588
+   https://github.com/owncloud/ocis/pull/4719
 # Changelog for [2.0.0-beta.8] (2022-09-13)
 
 The following sections list the changes for 2.0.0-beta.8.
diff --git a/changelog/unreleased/tokeninfo-endpoint-auth.md b/changelog/unreleased/tokeninfo-endpoint-auth.md
new file mode 100644
index 00000000000..856dfcb5817
--- /dev/null
+++ b/changelog/unreleased/tokeninfo-endpoint-auth.md
@@ -0,0 +1,5 @@
+Bugfix: Make tokeninfo endpoint unprotected
+
+Make the tokeninfo endpoint unprotected as it is supposed to be available to the public.
+
+https://github.com/owncloud/ocis/pull/4715
diff --git a/changelog/unreleased/update-reva-rc1.md b/changelog/unreleased/update-reva-rc1.md
index 09553bdd55c..3909b2777e1 100644
--- a/changelog/unreleased/update-reva-rc1.md
+++ b/changelog/unreleased/update-reva-rc1.md
@@ -3,3 +3,4 @@ Enhancement: Update reva
 TBD
 
 https://github.com/owncloud/ocis/pull/4588
+https://github.com/owncloud/ocis/pull/4719
diff --git a/go.mod b/go.mod
index 75068df520d..045a779415c 100644
--- a/go.mod
+++ b/go.mod
@@ -11,8 +11,8 @@ require (
 	github.com/blevesearch/bleve/v2 v2.3.4
 	github.com/blevesearch/bleve_index_api v1.0.3
 	github.com/coreos/go-oidc/v3 v3.4.0
-	github.com/cs3org/go-cs3apis v0.0.0-20220818202316-e92afdddac6d
-	github.com/cs3org/reva/v2 v2.10.1-0.20220927154108-3fb6adde0e8f
+	github.com/cs3org/go-cs3apis v0.0.0-20220929083235-bb0b1a236d6c
+	github.com/cs3org/reva/v2 v2.10.1-0.20220929124756-f2983940e36a
 	github.com/disintegration/imaging v1.6.2
 	github.com/ggwhite/go-masker v1.0.9
 	github.com/go-chi/chi/v5 v5.0.7
diff --git a/go.sum b/go.sum
index 6bd06a3fe6c..6f3abb87403 100644
--- a/go.sum
+++ b/go.sum
@@ -295,10 +295,10 @@ github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo
 github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4=
 github.com/crewjam/saml v0.4.6 h1:XCUFPkQSJLvzyl4cW9OvpWUbRf0gE7VUpU8ZnilbeM4=
 github.com/crewjam/saml v0.4.6/go.mod h1:ZBOXnNPFzB3CgOkRm7Nd6IVdkG+l/wF+0ZXLqD96t1A=
-github.com/cs3org/go-cs3apis v0.0.0-20220818202316-e92afdddac6d h1:toyZ7IsXlUdEPZ/IG8fg7hbM8HcLPY0bkX4FKBmgLVI=
-github.com/cs3org/go-cs3apis v0.0.0-20220818202316-e92afdddac6d/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
-github.com/cs3org/reva/v2 v2.10.1-0.20220927154108-3fb6adde0e8f h1:nCfCu5BQspeZmUGOmdcfZszibiTl4Lmy+8dS6Fpxpco=
-github.com/cs3org/reva/v2 v2.10.1-0.20220927154108-3fb6adde0e8f/go.mod h1:NfAt4eTciYZ8EZy/3U2oJDhkYGPZOjovulh8DRHV5RI=
+github.com/cs3org/go-cs3apis v0.0.0-20220929083235-bb0b1a236d6c h1:b+YTmOGlf43mnF8MzO0fsy8/Ho8JLu44Iq5Y0fKLJMM=
+github.com/cs3org/go-cs3apis v0.0.0-20220929083235-bb0b1a236d6c/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
+github.com/cs3org/reva/v2 v2.10.1-0.20220929124756-f2983940e36a h1:Yg3AmH0v41iEdHc+5/RQa+W1rqij3UPLwwFpH7gFveg=
+github.com/cs3org/reva/v2 v2.10.1-0.20220929124756-f2983940e36a/go.mod h1:0W93YjDTLBoBucKmQsvscNA3EyMTXteiHmv6hU8oLM4=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
diff --git a/services/proxy/pkg/middleware/authentication.go b/services/proxy/pkg/middleware/authentication.go
index 90ad1e6fba8..d32decfe59a 100644
--- a/services/proxy/pkg/middleware/authentication.go
+++ b/services/proxy/pkg/middleware/authentication.go
@@ -24,7 +24,8 @@ var (
 	_publicPaths = [...]string{
 		"/dav/public-files/",
 		"/remote.php/dav/public-files/",
-		"/remote.php/ocs/apps/files_sharing/api/v1/tokeninfo/unprotected",
+		"/ocs/v1.php/apps/files_sharing/api/v1/tokeninfo/unprotected",
+		"/ocs/v2.php/apps/files_sharing/api/v1/tokeninfo/unprotected",
 		"/ocs/v1.php/cloud/capabilities",
 	}
 )


Test patch:
diff --git a/services/proxy/pkg/middleware/authentication_test.go b/services/proxy/pkg/middleware/authentication_test.go
index 1188fefa343..17c151aebac 100644
--- a/services/proxy/pkg/middleware/authentication_test.go
+++ b/services/proxy/pkg/middleware/authentication_test.go
@@ -13,7 +13,8 @@ var _ = Describe("authentication helpers", func() {
 		},
 		Entry("public files path", "/remote.php/dav/public-files/", true),
 		Entry("public files path without remote.php", "/remote.php/dav/public-files/", true),
-		Entry("token info path", "/remote.php/ocs/apps/files_sharing/api/v1/tokeninfo/unprotected", true),
+		Entry("token info path", "/ocs/v1.php/apps/files_sharing/api/v1/tokeninfo/unprotected", true),
+		Entry("token info path", "/ocs/v2.php/apps/files_sharing/api/v1/tokeninfo/unprotected", true),
 		Entry("capabilities", "/ocs/v1.php/cloud/capabilities", true),
 	)
 })