From f4cdf4cac1a8f9c1f86efb0cc66f907758b1d66d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Mon, 11 Apr 2022 15:06:35 +0200 Subject: [PATCH] Defensively encode URL parameters when fetching ELB keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- .changeset/ninety-islands-report.md | 5 +++++ plugins/auth-backend/src/providers/aws-alb/provider.ts | 6 ++++-- 2 files changed, 9 insertions(+), 2 deletions(-) create mode 100644 .changeset/ninety-islands-report.md diff --git a/.changeset/ninety-islands-report.md b/.changeset/ninety-islands-report.md new file mode 100644 index 0000000000..4a515b75cd --- /dev/null +++ b/.changeset/ninety-islands-report.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Defensively encode URL parameters when fetching ELB keys diff --git a/plugins/auth-backend/src/providers/aws-alb/provider.ts b/plugins/auth-backend/src/providers/aws-alb/provider.ts index 12f7c7f4b4..5206dc125c 100644 --- a/plugins/auth-backend/src/providers/aws-alb/provider.ts +++ b/plugins/auth-backend/src/providers/aws-alb/provider.ts @@ -211,8 +211,10 @@ export class AwsAlbAuthProvider implements AuthProviderRouteHandlers { if (optionalCacheKey) { return crypto.createPublicKey(optionalCacheKey); } - const keyText: string = await fetch( - `https://public-keys.auth.elb.${this.region}.amazonaws.com/${keyId}`, + const keyText = await fetch( + `https://public-keys.auth.elb.${encodeURIComponent( + this.region, + )}.amazonaws.com/${encodeURIComponent(keyId)}`, ).then(response => response.text()); const keyValue = crypto.createPublicKey(keyText); this.keyCache.set(keyId, keyValue.export({ format: 'pem', type: 'spki' }));