Repository navigation
feat(plugins): add auth0 plugin commands - #1730
developerkunal wants to merge 1 commit into
Conversation
16481a3 to
a70abd8
Compare
a70abd8 to
e56cdaf
Compare
e56cdaf to
28a2e06
Compare
Add search, list, info, install, update, uninstall and approve behind a version gate (dev and prerelease builds only). Consent is asked per tenant at a terminal; non-interactive installs print the approve command. Docs are not generated while the feature is gated.
28a2e06 to
c3d8061
Compare
![semgrepcode-auth0[bot]](https://avatars.githubusercontent.com/in/977730?s=60&v=4){kind=small}
| _, _ = w.Write(answer.body[:len(answer.body)/2]) | ||
| panic(http.ErrAbortHandler) | ||
| default: | ||
| _, _ = w.Write(answer.body) |
There was a problem hiding this comment.
🟠 High severity blocking issue identified in your code:
Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention] (https://semgrep.dev/docs/cheat-sheets/go-xss/).
Why this might be safe to ignore:
The URL path is used only as a lookup key to retrieve a pre-configured route response body; the
answer.bodywritten to the response is server-controlled data, not user-supplied content derived from the request path. Additionally, this is a test helper file, making exploitation even less likely.
Dataflow graph
flowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>internal/plugins/registry/registrytest/server.go</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/registry/registrytest/server.go#L166 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 166] r.URL</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/registry/registrytest/server.go#L166 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 166] path</a>"]
v3["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/registry/registrytest/server.go#L181 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 181] answer</a>"]
end
v2 --> v3
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/registry/registrytest/server.go#L196 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 196] w.Write(answer.body)</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by no-direct-write-to-responsewriter-taint.
You can view more details about this finding in the Semgrep AppSec Platform.
| } | ||
|
|
||
| w.WriteHeader(response.status) | ||
| _, _ = w.Write(body) |
There was a problem hiding this comment.
🟠 High severity blocking issue identified in your code:
Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention] (https://semgrep.dev/docs/cheat-sheets/go-xss/).
Why this might be safe to ignore:
The data written to the response (
cleaned) is the upstream API's JSON response body processed throughstripSecrets, not a direct reflection of user-supplied input. The proxy reads the request body, forwards it to an upstream service, validates the response is JSON, strips secrets, and returns that - the taint tracking conflates the request body source with the upstream response data flowing to the sink.
Dataflow graph
flowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>internal/plugins/proxy/proxy.go</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/proxy/proxy.go#L489 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 489] r.Body</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/proxy/proxy.go#L489 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 489] body</a>"]
v3["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/proxy/proxy.go#L447 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 447] readRequestBody</a>"]
v4["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/proxy/proxy.go#L447 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 447] body</a>"]
v5["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/proxy/proxy.go#L454 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 454] {</a>"]
v6["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/proxy/proxy.go#L454 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 454] request</a>"]
v7["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/proxy/proxy.go#L462 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 462] response</a>"]
v8["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/proxy/proxy.go#L473 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 473] cleaned</a>"]
v9["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/proxy/proxy.go#L480 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 480] writeResponse</a>"]
v10["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/proxy/proxy.go#L663 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 663] body</a>"]
end
v2 --> v3
v3 --> v4
v4 --> v5
v5 --> v6
v6 --> v7
v7 --> v8
v8 --> v9
v9 --> v10
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/auth0/auth0-cli/blob/c3d80617c43dfe7d435d8840333a57f2051ef9c2/internal/plugins/proxy/proxy.go#L684 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 684] w.Write(body)</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by no-direct-write-to-responsewriter-taint.
You can view more details about this finding in the Semgrep AppSec Platform.
🔧 Changes
Adds the
auth0 plugincommand group (aliasplugins) withsearch,list,info,install,update,uninstall(aliasremove) andapprove, wired to the registry client, plugin store and approvals from the PRs below. The group is experimental and only registered in dev and prerelease builds, so a stable build is unchanged, and a newskipDocsannotation keeps it out of the generated docs. Running a plugin comes in a later PR.Commands
search [query]matches plugin IDs and descriptions.listshows installed plugins with version, pin and disk size. Both support--json,--json-compactand--csv.info <plugin>shows the owner, permissions, versions and the tenants where it is approved.install <plugin>installs from the signed registry, and an exact version pins it. In a terminal it shows the permissions and approves them for the tenant if the person agrees. Without a terminal, with--no-input, or in agent mode, it installs without an approval and prints theauth0 plugin approvecommand.update [plugin]orupdate --allskips pinned plugins. When the new version asks for other permissions and nobody can approve them, the installed version stays active and the command says why.uninstall <plugin>removes every version and the approvals, and asks for confirmation unless--forceis set. It refuses to run unconfirmed in agent mode.approve <plugin>approves the installed copy's permissions for a tenant. It needs a terminal and refuses in agent mode and with--no-input.Behaviour a reviewer should know
AUTH0_CLI_PLUGIN_APPROVALS.AUTH0_CLI_PLUGINS_DISABLEDturns offinstall,updateandapprove. Plugin commands do not require a login.installandupdatefail if the registry index could not be refreshed.installrefuses a plugin name that would shadow an existing command or alias.--tenant, thenAUTH0_DOMAINin env auth mode, then the default tenant. A--tenantthat contradictsAUTH0_DOMAINis an error.📚 References
DXCDT-2604. Part of the plugin framework stack of 11 PRs, and it builds on the one below it (DXCDT-2607).
🔬 Testing
The new code is covered by unit tests.
📝 Checklist