Repository: answerdev/answer
File: internal/router/plugin_api_router.go (Go)

Code before:
	}
}

func (pr *PluginAPIRouter) RegisterUnAuthConnectorRouter(r *gin.RouterGroup) {
	// connector plugin
	connectorController := pr.connectorController
	r.GET(controller.ConnectorLoginRouterPrefix+":name", connectorController.ConnectorLoginDispatcher)
	r.GET(controller.ConnectorRedirectRouterPrefix+":name", connectorController.ConnectorRedirectDispatcher)
	r.GET("/connector/info", connectorController.ConnectorsInfo)
	r.POST("/connector/binding/email", connectorController.ExternalLoginBindingUserSendEmail)

	// user center plugin
	r.GET("/user-center/agent", pr.userCenterController.UserCenterAgent)
	r.GET("/user-center/personal/branding", pr.userCenterController.UserCenterPersonalBranding)
	r.GET(controller.UserCenterLoginRouter, pr.userCenterController.UserCenterLoginRedirect)
	r.GET(controller.UserCenterSignUpRedirectRouter, pr.userCenterController.UserCenterSignUpRedirect)
	r.GET("/user-center/login/callback", pr.userCenterController.UserCenterLoginCallback)
	r.GET("/user-center/sign-up/callback", pr.userCenterController.UserCenterSignUpCallback)

	// captcha plugin
	r.GET("/captcha/config", pr.captchaController.GetCaptchaConfig)
	r.GET("/embed/config", pr.embedController.GetEmbedConfig)
	r.GET("/render/config", pr.renderController.GetRenderConfig)

	// importer plugin
	r.POST("/importer/answer", pr.importerController.ImportCommand)
}

func (pr *PluginAPIRouter) RegisterAuthUserConnectorRouter(r *gin.RouterGroup) {
	connectorController := pr.connectorController
	r.GET("/connector/user/info", connectorController.ConnectorsUserInfo)
	r.DELETE("/connector/user/unbinding", connectorController.ExternalLoginUnbinding)

	r.GET("/user-center/user/settings", pr.userCenterController.UserCenterUserSettings)
}

func (pr *PluginAPIRouter) RegisterAuthAdminConnectorRouter(r *gin.RouterGroup) {
	r.GET("/user-center/agent", pr.userCenterController.UserCenterAdminFunctionAgent)
}


Review comment (security):
Based on the design of the interface, it is clear that there is a problem here. The API exposed here is not authenticated, which means that any user can use this interface to add data, which is unsafe.

Code after:

func (pr *PluginAPIRouter) RegisterUnAuthConnectorRouter(r *gin.RouterGroup) {
	// connector plugin
	connectorController := pr.connectorController
	r.GET(controller.ConnectorLoginRouterPrefix+":name", connectorController.ConnectorLoginDispatcher)
	r.GET(controller.ConnectorRedirectRouterPrefix+":name", connectorController.ConnectorRedirectDispatcher)
	r.GET("/connector/info", connectorController.ConnectorsInfo)
	r.POST("/connector/binding/email", connectorController.ExternalLoginBindingUserSendEmail)

	// user center plugin
	r.GET("/user-center/agent", pr.userCenterController.UserCenterAgent)
	r.GET("/user-center/personal/branding", pr.userCenterController.UserCenterPersonalBranding)
	r.GET(controller.UserCenterLoginRouter, pr.userCenterController.UserCenterLoginRedirect)
	r.GET(controller.UserCenterSignUpRedirectRouter, pr.userCenterController.UserCenterSignUpRedirect)
	r.GET("/user-center/login/callback", pr.userCenterController.UserCenterLoginCallback)
	r.GET("/user-center/sign-up/callback", pr.userCenterController.UserCenterSignUpCallback)

	// captcha plugin
	r.GET("/captcha/config", pr.captchaController.GetCaptchaConfig)
	r.GET("/embed/config", pr.embedController.GetEmbedConfig)
	r.GET("/render/config", pr.renderController.GetRenderConfig)
}

func (pr *PluginAPIRouter) RegisterAuthUserConnectorRouter(r *gin.RouterGroup) {
	connectorController := pr.connectorController
	r.GET("/connector/user/info", connectorController.ConnectorsUserInfo)
	r.DELETE("/connector/user/unbinding", connectorController.ExternalLoginUnbinding)

	r.GET("/user-center/user/settings", pr.userCenterController.UserCenterUserSettings)
}

func (pr *PluginAPIRouter) RegisterAuthAdminConnectorRouter(r *gin.RouterGroup) {
	r.GET("/user-center/agent", pr.userCenterController.UserCenterAdminFunctionAgent)
}