diff --git a/Dockerfile b/Dockerfile index 03660873d..bcda7fa64 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ FROM thinxcloud/base:alpine LABEL maintainer="Matej Sychra " -LABEL name="THiNX API" version="1.9.2429" +LABEL name="THiNX API" version="1.9.2451" ARG DEBIAN_FRONTEND=noninteractive diff --git a/Dockerfile.test b/Dockerfile.test index 54c67194e..63c7a0e76 100644 --- a/Dockerfile.test +++ b/Dockerfile.test @@ -1,7 +1,7 @@ FROM thinxcloud/base:alpine LABEL maintainer="Matej Sychra " -LABEL name="THiNX API" version="1.9.2429" +LABEL name="THiNX API" version="1.9.2451" ARG DEBIAN_FRONTEND=noninteractive diff --git a/HISTORY.md b/HISTORY.md index 767cbe81d..b7b2bfbc4 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -2,7 +2,7 @@ ## HISTORY -6/11/2023 1.9.2429 +6/11/2023 1.9.2451 » Updating vulnerable components » Improving security configuration diff --git a/base b/base index 0409667d9..b5f7746bb 160000 --- a/base +++ b/base @@ -1 +1 @@ -Subproject commit 0409667d92316b73efc2ec8f369aff9fe9e43362 +Subproject commit b5f7746bb8e096c925c44ea642d12adff2e9bf6b diff --git a/lib/router.github.js b/lib/router.github.js index c3fb7786b..ea5e1abc8 100644 --- a/lib/router.github.js +++ b/lib/router.github.js @@ -181,8 +181,7 @@ module.exports = function (app) { } } - // added recently, seems to be missing/forgotten or deprecated or compatibility fix for testing or what? - // githubOAuth.addRoutes(app, callback); causes error 500 + // configure callbacks for Emitter events githubOAuth.on('error', (err) => { console.error('[debug] [oauth] [github] there was a login error', err); @@ -230,7 +229,7 @@ module.exports = function (app) { }); }); - callback(); // essentialy useless, why is this here?< + callback(); // async completes the secureGithubCallbacks() } // Initial page redirecting to OAuth2 provider diff --git a/lib/thinx/oauth-github.js b/lib/thinx/oauth-github.js index eaaf8c2f6..e79ea7803 100644 --- a/lib/thinx/oauth-github.js +++ b/lib/thinx/oauth-github.js @@ -14,21 +14,6 @@ module.exports = function (opts) { var redirectURI = url.format(urlObj); var emitter = new events.EventEmitter(); - // why is this unused? - function addRoutes(router, loginCallback) { - console.log("[debug] emitter.addRoutes called, keep this code even when it looks unreferenced!"); - // compatible with flatiron/director - router.get(opts.loginURI, login); - router.get(opts.callbackURI, callback); - if (!loginCallback) return; - emitter.on('error', function (token, err, resp, tokenResp, req) { - loginCallback(err, token, resp, tokenResp, req) - }); - emitter.on('token', function (token, resp, tokenResp, req) { - loginCallback(false, token, resp, tokenResp, req) - }); - } - function login(req, resp) { var u = 'https://github.com/login/oauth/authorize' + '?client_id=' + opts.githubClient @@ -42,7 +27,6 @@ module.exports = function (opts) { } function parseResponse(body) { - // 'access_token=gho_XXX&scope=user&token_type=bearer' const items = body.split("&"); var data = null; for (item in items) { @@ -54,7 +38,6 @@ module.exports = function (opts) { break; } } - console.log("[debug] [oauth-github] body, data ", {body}, {data}); return data; } @@ -78,27 +61,15 @@ module.exports = function (opts) { const body = await axios.get(u); console.log("[debug] emitting event token with body", { body }); const data = parseResponse(body.data); - - if (data == "bad_verification_code") { - // - } - - if (data.indexOf("'gho_") !== -1) { - // - } - - const q = url.parse(body.data, true).query; - console.log("[debug] emitting event token with data", { data }, JSON.stringify(q)); - if (cb) { - console.log("[debug] cb non-null, calling..."); - cb(null, data); + if (data.indexOf("gho_") !== -1) { + emitter.emit('token', data); + if (cb) return cb(null, data); + } else { + console.log("[debug] Invalid GitHub Response:", {body}); } - emitter.emit('token', data); } catch (e) { console.log("axios get error:", e); - if (cb) { - return cb(e); - } + if (cb) return cb(e); emitter.emit('error', null, e); } })() @@ -106,6 +77,5 @@ module.exports = function (opts) { emitter.login = login; emitter.callback = callback; - emitter.addRoutes = addRoutes; return emitter; } \ No newline at end of file diff --git a/package.json b/package.json index d382efc13..7ae0352ed 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "thinx", - "version": "1.9.2429", + "version": "1.9.2451", "description": "THiNX IoT Device Management API", "bugs": { "url": "https://github.com/suculent/thinx-device-api/issues" diff --git a/sonar-project.properties b/sonar-project.properties index e2463da12..69380ba35 100644 --- a/sonar-project.properties +++ b/sonar-project.properties @@ -4,7 +4,7 @@ sonar.organization=suculent sonar.sources=. sonar.host.url=https://sonarcloud.io -sonar.projectVersion=1.9.2429 +sonar.projectVersion=1.9.2451 sonar.sourceEncoding=UTF-8 sonar.junit.reportsPath=reports/