Nail/SQS-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: fix critical/high auth, idor, races and persistence

Browse Source
This commit is contained in:
Naeel
2026-04-10 19:41:59 +03:00
parent e9a26f7975
commit a5e9bfb15c
11 changed files with 868 additions and 505 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/admin/admin.go
+17 -1
View File
@@ -14,6 +14,7 @@ import (
"shared-sqs/app/auth"
"shared-sqs/app/models"
"shared-sqs/app/persistence"
"shared-sqs/app/tenant"
"github.com/google/uuid"
@@ -188,12 +189,18 @@ func (h *Handler) jwtMiddleware(next http.Handler) http.Handler {
}
// Проверяем что тенант существует (был создан при /ui/api/auth)
_, ok := h.store.GetBySub(claims.Sub)
jwtTenant, ok := h.store.GetBySub(claims.Sub)
if !ok {
jsonErr(w, http.StatusForbidden, "tenant not found — authenticate first via POST /ui/api/auth")
return
}
// IDOR защита: для /ui/api/tenants/{id}/... разрешаем доступ только к своему tenant ID.
if pathTenantID, exists := mux.Vars(r)["id"]; exists && pathTenantID != "" && pathTenantID != jwtTenant.ID {
jsonErr(w, http.StatusForbidden, "forbidden tenant access")
return
}
next.ServeHTTP(w, r)
})
}
@@ -315,13 +322,18 @@ func (h *Handler) deleteTenant(w http.ResponseWriter, r *http.Request) {
}
// Удаляем все очереди тенанта из SyncQueues
prefix := t.AccessKey + ":"
deletedQueueKeys := make([]string, 0)
models.SyncQueues.Lock()
for key := range models.SyncQueues.Queues {
if strings.HasPrefix(key, prefix) {
deletedQueueKeys = append(deletedQueueKeys, key)
delete(models.SyncQueues.Queues, key)
}
}
models.SyncQueues.Unlock()
for _, queueKey := range deletedQueueKeys {
persistence.DeleteQueue(queueKey)
}
h.store.Delete(id)
w.WriteHeader(http.StatusNoContent)
@@ -427,6 +439,7 @@ func (h *Handler) createTenantQueue(w http.ResponseWriter, r *http.Request) {
Messages: []models.SqsMessage{},
Duplicates: make(map[string]time.Time),
}
persistence.SaveQueue(key, models.SyncQueues.Queues[key])
models.SyncQueues.Unlock()
log.Infof("admin: created queue %s for tenant %s", req.Name, t.ID)
w.Header().Set("Content-Type", "application/json")
@@ -453,6 +466,7 @@ func (h *Handler) deleteTenantQueue(w http.ResponseWriter, r *http.Request) {
}
delete(models.SyncQueues.Queues, key)
models.SyncQueues.Unlock()
persistence.DeleteQueue(key)
log.Infof("admin: deleted queue %s for tenant %s", queueName, t.ID)
w.WriteHeader(http.StatusNoContent)
}
@@ -552,6 +566,7 @@ func (h *Handler) sendMessageToQueue(w http.ResponseWriter, r *http.Request) {
}
models.SyncQueues.Lock()
models.SyncQueues.Queues[key].Messages = append(models.SyncQueues.Queues[key].Messages, msg)
persistence.SaveQueue(key, models.SyncQueues.Queues[key])
models.SyncQueues.Unlock()
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusCreated)
@@ -575,6 +590,7 @@ func (h *Handler) purgeQueue(w http.ResponseWriter, r *http.Request) {
}
models.SyncQueues.Lock()
models.SyncQueues.Queues[key].Messages = models.SyncQueues.Queues[key].Messages[:0]
persistence.SaveQueue(key, models.SyncQueues.Queues[key])
models.SyncQueues.Unlock()
log.Infof("admin: purged queue %s for tenant %s", queueName, t.ID)
w.WriteHeader(http.StatusNoContent)
app/auth/auth_middleware.go
+325
View File
@@ -4,10 +4,22 @@
package auth
import (
"bytes"
"context"
"crypto/hmac"
"crypto/sha256"
"crypto/subtle"
"encoding/hex"
"encoding/xml"
"errors"
"fmt"
"io"
"net/http"
"net/url"
"sort"
"strconv"
"strings"
"time"
"shared-sqs/app/tenant"
)
@@ -18,6 +30,11 @@ type contextKey string
const TenantContextKey contextKey = "tenant"
const (
sigV4DateFormat = "20060102T150405Z"
maxClockSkew = 15 * time.Minute
)
// AuthMiddleware — middleware: ищет тенанта по AccessKeyId из AWS Authorization header.
// Пропускает /health и /admin/** без tenant-аутентификации.
// Ловушка #4: не ставим короткий таймаут — ReceiveMessage с long polling держит соединение до 20 сек.
@@ -47,6 +64,11 @@ writeSQSAuthError(w, "InvalidClientTokenId", "The security token included in the
return
}
if err := verifySigV4(r, t); err != nil {
writeSQSAuthError(w, "SignatureDoesNotMatch", err.Error())
return
}
ctx := context.WithValue(r.Context(), TenantContextKey, t)
next.ServeHTTP(w, r.WithContext(ctx))
})
@@ -84,6 +106,309 @@ return parts[0]
return ""
}
// verifySigV4 — полноценная проверка подписи AWS SigV4 для header и presigned запросов.
func verifySigV4(r *http.Request, t *tenant.Tenant) error {
authHeader := r.Header.Get("Authorization")
if strings.HasPrefix(authHeader, "AWS4-HMAC-SHA256") {
return verifyHeaderSigV4(r, t, authHeader)
}
if r.URL.Query().Get("X-Amz-Credential") != "" {
return verifyPresignedSigV4(r, t)
}
return errors.New("missing SigV4 authorization")
}
func verifyHeaderSigV4(r *http.Request, t *tenant.Tenant, authHeader string) error {
credential, signedHeaders, providedSignature, err := parseAuthorizationHeader(authHeader)
if err != nil {
return err
}
accessKey, shortDate, region, service, terminal, err := parseCredentialScope(credential)
if err != nil {
return err
}
if accessKey != t.AccessKey {
return errors.New("access key mismatch")
}
if service != "sqs" || terminal != "aws4_request" {
return errors.New("invalid credential scope")
}
amzDate := r.Header.Get("X-Amz-Date")
if amzDate == "" {
return errors.New("missing X-Amz-Date header")
}
requestTime, err := time.Parse(sigV4DateFormat, amzDate)
if err != nil {
return fmt.Errorf("invalid X-Amz-Date: %w", err)
}
if absDuration(time.Now().UTC().Sub(requestTime)) > maxClockSkew {
return errors.New("request time skew is too large")
}
body, err := readAndRestoreBody(r)
if err != nil {
return err
}
payloadHash := r.Header.Get("X-Amz-Content-Sha256")
if payloadHash == "" {
payloadHash = sha256Hex(body)
}
canonicalRequest, err := buildCanonicalRequest(r, signedHeaders, payloadHash, true)
if err != nil {
return err
}
credentialScope := strings.Join([]string{shortDate, region, service, terminal}, "/")
stringToSign := buildStringToSign(amzDate, credentialScope, canonicalRequest)
expectedSignature := calculateSigV4Signature(t.SecretKey, shortDate, region, service, stringToSign)
if subtle.ConstantTimeCompare([]byte(strings.ToLower(expectedSignature)), []byte(strings.ToLower(providedSignature))) != 1 {
return errors.New("signature mismatch")
}
return nil
}
func verifyPresignedSigV4(r *http.Request, t *tenant.Tenant) error {
query := r.URL.Query()
if query.Get("X-Amz-Algorithm") != "AWS4-HMAC-SHA256" {
return errors.New("unsupported X-Amz-Algorithm")
}
credential := query.Get("X-Amz-Credential")
if credential == "" {
return errors.New("missing X-Amz-Credential")
}
providedSignature := query.Get("X-Amz-Signature")
if providedSignature == "" {
return errors.New("missing X-Amz-Signature")
}
signedHeaders := query.Get("X-Amz-SignedHeaders")
if signedHeaders == "" {
return errors.New("missing X-Amz-SignedHeaders")
}
amzDate := query.Get("X-Amz-Date")
if amzDate == "" {
return errors.New("missing X-Amz-Date")
}
expiresSeconds, err := strconv.Atoi(query.Get("X-Amz-Expires"))
if err != nil || expiresSeconds < 1 || expiresSeconds > 604800 {
return errors.New("invalid X-Amz-Expires")
}
requestTime, err := time.Parse(sigV4DateFormat, amzDate)
if err != nil {
return fmt.Errorf("invalid X-Amz-Date: %w", err)
}
if time.Now().UTC().After(requestTime.Add(time.Duration(expiresSeconds) * time.Second)) {
return errors.New("presigned request has expired")
}
accessKey, shortDate, region, service, terminal, err := parseCredentialScope(credential)
if err != nil {
return err
}
if accessKey != t.AccessKey {
return errors.New("access key mismatch")
}
if service != "sqs" || terminal != "aws4_request" {
return errors.New("invalid credential scope")
}
body, err := readAndRestoreBody(r)
if err != nil {
return err
}
payloadHash := query.Get("X-Amz-Content-Sha256")
if payloadHash == "" {
payloadHash = r.Header.Get("X-Amz-Content-Sha256")
}
if payloadHash == "" {
payloadHash = "UNSIGNED-PAYLOAD"
if len(body) > 0 {
payloadHash = sha256Hex(body)
}
}
canonicalRequest, err := buildCanonicalRequest(r, signedHeaders, payloadHash, false)
if err != nil {
return err
}
credentialScope := strings.Join([]string{shortDate, region, service, terminal}, "/")
stringToSign := buildStringToSign(amzDate, credentialScope, canonicalRequest)
expectedSignature := calculateSigV4Signature(t.SecretKey, shortDate, region, service, stringToSign)
if subtle.ConstantTimeCompare([]byte(strings.ToLower(expectedSignature)), []byte(strings.ToLower(providedSignature))) != 1 {
return errors.New("signature mismatch")
}
return nil
}
func parseAuthorizationHeader(authHeader string) (credential string, signedHeaders string, signature string, err error) {
if !strings.HasPrefix(authHeader, "AWS4-HMAC-SHA256") {
return "", "", "", errors.New("unsupported authorization algorithm")
}
fields := strings.Split(strings.TrimSpace(strings.TrimPrefix(authHeader, "AWS4-HMAC-SHA256")), ",")
parts := map[string]string{}
for _, field := range fields {
kv := strings.SplitN(strings.TrimSpace(field), "=", 2)
if len(kv) != 2 {
continue
}
parts[kv[0]] = kv[1]
}
credential = parts["Credential"]
signedHeaders = strings.ToLower(parts["SignedHeaders"])
signature = parts["Signature"]
if credential == "" || signedHeaders == "" || signature == "" {
return "", "", "", errors.New("malformed Authorization header")
}
return credential, signedHeaders, signature, nil
}
func parseCredentialScope(credential string) (accessKey, shortDate, region, service, terminal string, err error) {
parts := strings.Split(credential, "/")
if len(parts) != 5 {
return "", "", "", "", "", errors.New("invalid Credential scope")
}
return parts[0], parts[1], parts[2], parts[3], parts[4], nil
}
func buildCanonicalRequest(r *http.Request, signedHeaders, payloadHash string, includeSignatureQuery bool) (string, error) {
canonicalURI := r.URL.EscapedPath()
if canonicalURI == "" {
canonicalURI = "/"
}
canonicalQuery := canonicalizeQueryString(r.URL.Query(), includeSignatureQuery)
headers := strings.Split(strings.ToLower(signedHeaders), ";")
canonicalHeaders := strings.Builder{}
cleanSignedHeaders := make([]string, 0, len(headers))
for _, h := range headers {
name := strings.TrimSpace(h)
if name == "" {
continue
}
value, ok := canonicalHeaderValue(r, name)
if !ok {
return "", fmt.Errorf("missing signed header: %s", name)
}
canonicalHeaders.WriteString(name)
canonicalHeaders.WriteString(":")
canonicalHeaders.WriteString(normalizeHeaderSpace(value))
canonicalHeaders.WriteString("\n")
cleanSignedHeaders = append(cleanSignedHeaders, name)
}
if len(cleanSignedHeaders) == 0 {
return "", errors.New("empty signed headers")
}
return strings.Join([]string{
r.Method,
canonicalURI,
canonicalQuery,
canonicalHeaders.String(),
strings.Join(cleanSignedHeaders, ";"),
payloadHash,
}, "\n"), nil
}
func canonicalHeaderValue(r *http.Request, name string) (string, bool) {
if name == "host" {
h := r.Host
if h == "" {
h = r.URL.Host
}
return h, h != ""
}
key := http.CanonicalHeaderKey(name)
values, ok := r.Header[key]
if !ok || len(values) == 0 {
return "", false
}
return strings.Join(values, ","), true
}
func canonicalizeQueryString(query url.Values, includeSignature bool) string {
pairs := make([]string, 0)
for key, values := range query {
if !includeSignature && strings.EqualFold(key, "X-Amz-Signature") {
continue
}
sortedValues := append([]string(nil), values...)
sort.Strings(sortedValues)
if len(sortedValues) == 0 {
pairs = append(pairs, awsPercentEncode(key)+"=")
continue
}
for _, value := range sortedValues {
pairs = append(pairs, awsPercentEncode(key)+"="+awsPercentEncode(value))
}
}
sort.Strings(pairs)
return strings.Join(pairs, "&")
}
func awsPercentEncode(s string) string {
encoded := url.QueryEscape(s)
encoded = strings.ReplaceAll(encoded, "+", "%20")
encoded = strings.ReplaceAll(encoded, "*", "%2A")
encoded = strings.ReplaceAll(encoded, "%7E", "~")
return encoded
}
func normalizeHeaderSpace(v string) string {
return strings.Join(strings.Fields(strings.TrimSpace(v)), " ")
}
func buildStringToSign(amzDate, credentialScope, canonicalRequest string) string {
canonicalHash := sha256.Sum256([]byte(canonicalRequest))
return strings.Join([]string{
"AWS4-HMAC-SHA256",
amzDate,
credentialScope,
hex.EncodeToString(canonicalHash[:]),
}, "\n")
}
func calculateSigV4Signature(secretKey, shortDate, region, service, stringToSign string) string {
kDate := hmacSHA256([]byte("AWS4"+secretKey), shortDate)
kRegion := hmacSHA256(kDate, region)
kService := hmacSHA256(kRegion, service)
kSigning := hmacSHA256(kService, "aws4_request")
sig := hmacSHA256(kSigning, stringToSign)
return hex.EncodeToString(sig)
}
func hmacSHA256(key []byte, data string) []byte {
m := hmac.New(sha256.New, key)
_, _ = m.Write([]byte(data))
return m.Sum(nil)
}
func readAndRestoreBody(r *http.Request) ([]byte, error) {
if r.Body == nil {
return nil, nil
}
body, err := io.ReadAll(r.Body)
if err != nil {
return nil, fmt.Errorf("read request body: %w", err)
}
r.Body = io.NopCloser(bytes.NewReader(body))
return body, nil
}
func sha256Hex(data []byte) string {
sum := sha256.Sum256(data)
return hex.EncodeToString(sum[:])
}
func absDuration(d time.Duration) time.Duration {
if d < 0 {
return -d
}
return d
}
// sqsAuthError — AWS-совместимый XML ответ об ошибке аутентификации.
type sqsAuthError struct {
XMLName xml.Name `xml:"ErrorResponse"`
app/gosqs/delete_message_batch.go
+6 -3
View File
@@ -6,11 +6,12 @@ import (
"net/http"
"strings"
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
"github.com/gorilla/mux"
log "github.com/sirupsen/logrus"
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/persistence"
"shared-sqs/app/utils"
)
func DeleteMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
@@ -86,6 +87,8 @@ remainingMessages = append(remainingMessages, message)
}
models.SyncQueues.Queues[key].Messages = remainingMessages
// Персистим обновлённое состояние очереди, чтобы не терять batch-delete после рестарта.
persistence.SaveQueue(key, models.SyncQueues.Queues[key])
notFoundEntries := make([]models.BatchResultErrorEntry, 0)
for _, de := range deleteMessageMap {
app/gosqs/get_queue_url.go
+1
View File
@@ -8,6 +8,7 @@ import (
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
log "github.com/sirupsen/logrus"
)
app/gosqs/list_queues.go
+3 -3
View File
@@ -7,10 +7,10 @@ import (
"net/http"
"strings"
log "github.com/sirupsen/logrus"
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
log "github.com/sirupsen/logrus"
)
func ListQueuesV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
@@ -30,7 +30,7 @@ log.Infof("Listing Queues for tenant: %s", t.ID)
queueUrls := make([]string, 0)
prefix := t.AccessKey + ":"
models.SyncQueues.Lock()
models.SyncQueues.RLock()
for key, queue := range models.SyncQueues.Queues {
// Показываем только очереди этого тенанта
if strings.HasPrefix(key, prefix) {
@@ -39,7 +39,7 @@ queueUrls = append(queueUrls, queue.URL)
}
}
}
models.SyncQueues.Unlock()
models.SyncQueues.RUnlock()
respStruct := models.ListQueuesResponse{
Xmlns: models.BaseXmlns,
app/gosqs/receive_message.go
+1
View File
@@ -14,6 +14,7 @@ import (
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
"github.com/gorilla/mux"
log "github.com/sirupsen/logrus"
)
app/gosqs/send_message.go
+10 -8
View File
@@ -63,25 +63,27 @@ func SendMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
key := tenantQueueKey(t.AccessKey, queueName)
if _, ok := models.SyncQueues.Queues[key]; !ok {
models.SyncQueues.RLock()
queue, exists := models.SyncQueues.Queues[key]
if !exists {
models.SyncQueues.RUnlock()
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
maxMessageSize := queue.MaximumMessageSize
currentMsgCount := len(queue.Messages)
queueIsFIFO := queue.IsFIFO
delaySecs := queue.DelaySeconds
models.SyncQueues.RUnlock()
if models.SyncQueues.Queues[key].MaximumMessageSize > 0 &&
len(messageBody) > models.SyncQueues.Queues[key].MaximumMessageSize {
if maxMessageSize > 0 && len(messageBody) > maxMessageSize {
return utils.CreateErrorResponseV1("MessageTooBig", true)
}
// Fix #11: лимит сообщений в очереди — защита от OOM
models.SyncQueues.RLock()
currentMsgCount := len(models.SyncQueues.Queues[key].Messages)
queueIsFIFO := models.SyncQueues.Queues[key].IsFIFO
models.SyncQueues.RUnlock()
if currentMsgCount >= MaxMessagesForQueue(queueIsFIFO) {
return utils.CreateErrorResponseV1("OverLimit", true)
}
delaySecs := models.SyncQueues.Queues[key].DelaySeconds
if requestBody.DelaySeconds != 0 {
delaySecs = requestBody.DelaySeconds
}
app/gosqs/send_message_batch.go
+20 -13
View File
@@ -11,7 +11,9 @@ import (
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/persistence"
"shared-sqs/app/utils"
"github.com/gorilla/mux"
log "github.com/sirupsen/logrus"
)
@@ -41,9 +43,16 @@ queueName = uriSegments[len(uriSegments)-1]
key := tenantQueueKey(t.AccessKey, queueName)
if _, ok := models.SyncQueues.Queues[key]; !ok {
models.SyncQueues.RLock()
queue, exists := models.SyncQueues.Queues[key]
if !exists {
models.SyncQueues.RUnlock()
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
maxMsgSize := queue.MaximumMessageSize
currentMsgCount := len(queue.Messages)
queueIsFIFO := queue.IsFIFO
models.SyncQueues.RUnlock()
sendEntries := requestBody.Entries
@@ -77,7 +86,6 @@ sentEntries := make([]models.SendMessageBatchResultEntry, 0)
log.Debugf("Batch sending to Queue: %s (tenant: %s)", queueName, t.ID)
// Fix #2: проверяем размер каждого сообщения в batch (Critical — batch size bypass)
maxMsgSize := models.SyncQueues.Queues[key].MaximumMessageSize
if maxMsgSize <= 0 {
maxMsgSize = MaxMessageSizeDefault
}
@@ -92,14 +100,12 @@ return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
// Fix #11: лимит сообщений в очереди — защита от OOM
models.SyncQueues.RLock()
currentMsgCount := len(models.SyncQueues.Queues[key].Messages)
queueIsFIFO := models.SyncQueues.Queues[key].IsFIFO
models.SyncQueues.RUnlock()
if currentMsgCount+len(sendEntries) > MaxMessagesForQueue(queueIsFIFO) {
return utils.CreateErrorResponseV1("OverLimit", true)
}
models.SyncQueues.Lock()
queue = models.SyncQueues.Queues[key]
for _, sendEntry := range sendEntries {
msg := models.SqsMessage{MessageBody: sendEntry.MessageBody}
if len(sendEntry.MessageAttributes) > 0 {
@@ -112,18 +118,16 @@ msg.DeduplicationID = sendEntry.MessageDeduplicationId
msg.Uuid = uuid.NewString()
msg.SentTime = time.Now()
models.SyncQueues.Lock()
fifoSeqNumber := ""
if models.SyncQueues.Queues[key].IsFIFO {
fifoSeqNumber = models.SyncQueues.Queues[key].NextSequenceNumber(sendEntry.MessageGroupId)
if queue.IsFIFO {
fifoSeqNumber = queue.NextSequenceNumber(sendEntry.MessageGroupId)
}
if !models.SyncQueues.Queues[key].IsDuplicate(sendEntry.MessageDeduplicationId) {
models.SyncQueues.Queues[key].Messages = append(models.SyncQueues.Queues[key].Messages, msg)
if !queue.IsDuplicate(sendEntry.MessageDeduplicationId) {
queue.Messages = append(queue.Messages, msg)
} else {
log.Debugf("Duplicate deduplicationId [%s] in queue [%s]", sendEntry.MessageDeduplicationId, queueName)
}
models.SyncQueues.Queues[key].InitDuplicatation(sendEntry.MessageDeduplicationId)
models.SyncQueues.Unlock()
queue.InitDuplicatation(sendEntry.MessageDeduplicationId)
sentEntries = append(sentEntries, models.SendMessageBatchResultEntry{
Id: sendEntry.Id,
@@ -134,6 +138,9 @@ SequenceNumber: fifoSeqNumber,
})
log.Infof("%s: Queue: %s, Message: %s", time.Now().Format("2006-01-02 15:04:05"), queueName, msg.MessageBody)
}
// Персистим батч-изменение одним снапшотом под lock.
persistence.SaveQueue(key, queue)
models.SyncQueues.Unlock()
respStruct := models.SendMessageBatchResponse{
Xmlns: models.BaseXmlns,
app/router/router.go
+5 -1
View File
@@ -147,7 +147,11 @@ func extractAction(req *http.Request) string {
switch protocol {
case AwsJsonProtocol:
action := req.Header.Get("X-Amz-Target")
return strings.Split(action, ".")[1]
parts := strings.SplitN(action, ".", 2)
if len(parts) != 2 || parts[1] == "" {
return ""
}
return parts[1]
case AwsQueryProtocol:
return req.FormValue("Action")
}
app/tenant/tenant_store.go
+4
View File
@@ -202,6 +202,10 @@ func (s *TenantStore) CreateFromJWT(tenantID, sub, email string, maxQueues int)
s.mu.Unlock()
return existing, nil
}
if len(s.byID) >= MaxTenantsGlobal {
s.mu.Unlock()
return nil, fmt.Errorf("global tenant limit reached (%d)", MaxTenantsGlobal)
}
accessKey, err := generateAccessKey()
if err != nil {