Affected by GO-2023-2012 and 6 other vulnerabilities

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

GO-2024-3291: Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs

GO-2025-3479: lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs

GO-2025-4090: lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs

oidc

package

v0.93.0 Latest Latest Go to latest Published: Feb 8, 2023 License: Apache-2.0 Imports: 5 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/treeverse/lakefs

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
type Authenticator
- func NewAuthenticator(oauthConfig *oauth2.Config, oidcProvider *oidc.Provider) *Authenticator
- func (a *Authenticator) GetIDTokenClaims(ctx context.Context, code string) (Claims, error)
type Claims

Constants ¶

This section is empty.

Variables ¶

View Source

var ErrTokenExtract = errors.New("failed to extract id token")

Functions ¶

This section is empty.

Types ¶

type Authenticator ¶

type Authenticator struct {
	// contains filtered or unexported fields
}

func NewAuthenticator ¶

func NewAuthenticator(oauthConfig *oauth2.Config, oidcProvider *oidc.Provider) *Authenticator

func (*Authenticator) GetIDTokenClaims ¶

func (a *Authenticator) GetIDTokenClaims(ctx context.Context, code string) (Claims, error)

GetIDTokenClaims exchanges a temporary code for an ID token. The ID token is verified to be valid, and its Claims are then returned.

type Claims ¶

type Claims = encoding.Claims

Claims is encoding.Claims. To preserve serialization, it must be an alias declaration of encoding.Claims (with an "=") and not a type declaration.

Source Files ¶

View all Source files

authenticator.go

Directories ¶

Path	Synopsis
encoding Package encoding defines Claims for interoperable external services to use in JWTs.	Package encoding defines Claims for interoperable external services to use in JWTs.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL