Repository: Infisical/infisical
File: backend/src/services/identity-aws-auth/identity-aws-auth-service.ts (TypeScript)

Code before:
  const validRegionPattern = new RE2("^[a-z0-9-]+$");
  if (typeof region !== "string" || region.length === 0 || region.length > 20) {
    return false;
  }

  return validRegionPattern.test(region);
}

export const identityAwsAuthServiceFactory = ({
  identityAccessTokenDAL,
  identityAwsAuthDAL,
  identityOrgMembershipDAL,
  licenseService,
  permissionService
}: TIdentityAwsAuthServiceFactoryDep) => {
  const login = async ({ identityId, iamHttpRequestMethod, iamRequestBody, iamRequestHeaders }: TLoginAwsAuthDTO) => {
    const identityAwsAuth = await identityAwsAuthDAL.findOne({ identityId });
    if (!identityAwsAuth) {
      throw new NotFoundError({ message: "AWS auth method not found for identity, did you configure AWS auth?" });
    }

    const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityAwsAuth.identityId });

    const headers: TAwsGetCallerIdentityHeaders = JSON.parse(Buffer.from(iamRequestHeaders, "base64").toString());
    const body: string = Buffer.from(iamRequestBody, "base64").toString();
    const region = headers.authorization ? awsRegionFromHeader(headers.Authorization || headers.authorization) : null;

    if (!isValidAwsRegion(region)) {
      throw new BadRequestError({ message: "Invalid AWS region" });
    }

    const url = region ? `https://sts.${region}.amazonaws.com` : identityAwsAuth.stsEndpoint;

    const {
      data: {
        GetCallerIdentityResponse: {
          GetCallerIdentityResult: { Account, Arn }
        }
      }
    }: { data: TGetCallerIdentityResponse } = await axios({
      method: iamHttpRequestMethod,
      url,
      headers,
      data: body
    });

    if (identityAwsAuth.allowedAccountIds) {
      // validate if Account is in the list of allowed Account IDs

      const isAccountAllowed = identityAwsAuth.allowedAccountIds
        .split(",")

Review comment (security):
isn't this going to make that any request with `headers.Authorization` have a null value? also if `headers.authorization` is true, the condition is checking first `headers.Authorization`, is this intended?

Code after:
  const validRegionPattern = new RE2("^[a-z0-9-]+$");
  if (typeof region !== "string" || region.length === 0 || region.length > 20) {
    return false;
  }

  return validRegionPattern.test(region);
}

export const identityAwsAuthServiceFactory = ({
  identityAccessTokenDAL,
  identityAwsAuthDAL,
  identityOrgMembershipDAL,
  licenseService,
  permissionService
}: TIdentityAwsAuthServiceFactoryDep) => {
  const login = async ({ identityId, iamHttpRequestMethod, iamRequestBody, iamRequestHeaders }: TLoginAwsAuthDTO) => {
    const identityAwsAuth = await identityAwsAuthDAL.findOne({ identityId });
    if (!identityAwsAuth) {
      throw new NotFoundError({ message: "AWS auth method not found for identity, did you configure AWS auth?" });
    }

    const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityAwsAuth.identityId });

    const headers: TAwsGetCallerIdentityHeaders = JSON.parse(Buffer.from(iamRequestHeaders, "base64").toString());
    const body: string = Buffer.from(iamRequestBody, "base64").toString();

    const authHeader = headers.Authorization || headers.authorization;
    const region = authHeader ? awsRegionFromHeader(authHeader) : null;

    if (!isValidAwsRegion(region)) {
      throw new BadRequestError({ message: "Invalid AWS region" });
    }

    const url = region ? `https://sts.${region}.amazonaws.com` : identityAwsAuth.stsEndpoint;

    const {
      data: {
        GetCallerIdentityResponse: {
          GetCallerIdentityResult: { Account, Arn }
        }
      }
    }: { data: TGetCallerIdentityResponse } = await axios({
      method: iamHttpRequestMethod,
      url,
      headers,
      data: body
    });

    if (identityAwsAuth.allowedAccountIds) {
      // validate if Account is in the list of allowed Account IDs