This is an automated email from the ASF dual-hosted git repository.
Aias00 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/shenyu.git
The following commit(s) were added to refs/heads/master by this push:
new 9181fb155e [fix] Add missing permission annotations to
/appAuth/updateSk and /sandbox/proxyGateway (#6388)
9181fb155e is described below
commit 9181fb155ebd721b875b77f9840b5ad281d42a99
Author: aias00 <[email protected]>
AuthorDate: Tue Jul 7 10:27:26 2026 +0800
[fix] Add missing permission annotations to /appAuth/updateSk and
/sandbox/proxyGateway (#6388)
* goalx: snapshot before shenyu-analysis
* chore(ci): optimize workflow build cache and mvnd parallelism
* chore: update LICENSE with new dependencies and versions
* [fix] Add missing permission annotations to /appAuth/updateSk and
/sandbox/proxyGateway
- Add @RequiresPermissions("system:authen:edit") to
AppAuthController.updateSk()
This endpoint was the only one in the controller without a permission
check,
allowing any authenticated user to rotate arbitrary appAuth secrets.
- Change /appAuth/updateSk from GET to POST to prevent appSecret from
appearing in URLs, browser history, and server access logs.
- Add @RequiresPermissions("system:authen:list") to
SandboxController.proxyGateway()
This endpoint generates server-side signed requests using stored
appSecrets.
Without permission checks, any authenticated user could abuse it to forge
signed requests after compromising an appKey via the updateSk
vulnerability.
These fixes address an authorization bypass where a low-privileged dashboard
user could chain updateSk + proxyGateway to impersonate arbitrary
application
identities and send authenticated requests to allowlisted internal services.
Co-Authored-By: Claude <[email protected]>
* [fix] Address PR review: use request body for updateSk, fix sandbox
permission, revert unrelated LICENSE changes
- Change /appAuth/updateSk to accept UpdateSkDTO as @RequestBody instead
of @RequestParam, preventing appSecret from appearing in URLs, browser
history, and server access logs (Copilot review comment #1)
- Change /sandbox/proxyGateway permission from system:authen:list to
system:authen:modify — a write/signing endpoint should not be guarded
by a read permission (Copilot review comment #3)
- Revert unrelated LICENSE file changes that were accidentally included
(Copilot review comment #2 — re2j license issue is pre-existing)
Co-Authored-By: Claude <[email protected]>
---------
Co-authored-by: Claude <[email protected]>
Co-authored-by: xiaoyu <[email protected]>
---
.../http/http-debug-app-auth-controller-api.http | 6 +-
.../shenyu/admin/controller/AppAuthController.java | 15 ++--
.../shenyu/admin/controller/SandboxController.java | 2 +
.../apache/shenyu/admin/model/dto/UpdateSkDTO.java | 100 +++++++++++++++++++++
.../admin/controller/AppAuthControllerTest.java | 14 ++-
5 files changed, 122 insertions(+), 15 deletions(-)
diff --git a/shenyu-admin/src/http/http-debug-app-auth-controller-api.http
b/shenyu-admin/src/http/http-debug-app-auth-controller-api.http
index be9a97abbc..2de236d9c1 100644
--- a/shenyu-admin/src/http/http-debug-app-auth-controller-api.http
+++ b/shenyu-admin/src/http/http-debug-app-auth-controller-api.http
@@ -61,14 +61,14 @@ X-Access-Token:
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyTmFtZSI6ImFkbWluIiw
}
### updateSk
-GET http://localhost:9095/appAuth/updateSk?appKey=123&appSecret=123
+POST http://localhost:9095/appAuth/updateSk
Accept: application/json
Content-Type: application/json
X-Access-Token:
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyTmFtZSI6ImFkbWluIiwiZXhwIjoxNjQ4NjUwMDg2fQ.aDeChT_Ey6FwYDdzSkc9ZLBHd5v-LVUZ6BPcYqJCo-Y
{
- "id": 123,
- "name": "order"
+ "appKey": "123",
+ "appSecret": "123"
}
### app auth list by page
diff --git
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AppAuthController.java
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AppAuthController.java
index d96d6839c7..ee2ab01cf2 100644
---
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AppAuthController.java
+++
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AppAuthController.java
@@ -26,6 +26,7 @@ import org.apache.shenyu.admin.model.dto.AppAuthDTO;
import org.apache.shenyu.admin.model.dto.AuthApplyDTO;
import org.apache.shenyu.admin.model.dto.AuthPathWarpDTO;
import org.apache.shenyu.admin.model.dto.BatchCommonDTO;
+import org.apache.shenyu.admin.model.dto.UpdateSkDTO;
import org.apache.shenyu.admin.model.page.CommonPager;
import org.apache.shenyu.admin.model.page.PageParameter;
import org.apache.shenyu.admin.model.query.AppAuthQuery;
@@ -33,7 +34,6 @@ import org.apache.shenyu.admin.model.result.ShenyuAdminResult;
import org.apache.shenyu.admin.model.vo.AppAuthVO;
import org.apache.shenyu.admin.service.AppAuthService;
import org.apache.shenyu.admin.service.PageService;
-import org.apache.shenyu.admin.service.provider.AppKeyProvider;
import org.apache.shenyu.admin.utils.ShenyuResultMessage;
import org.apache.shenyu.admin.validation.annotation.Existed;
import org.apache.shiro.authz.annotation.RequiresPermissions;
@@ -78,16 +78,13 @@ public class AppAuthController implements
PagedController<AppAuthQuery, AppAuthV
/**
* Update sk of App auth.
*
- * @param appKey the app key
- * @param appSecret the app secret
+ * @param updateSkDTO the update sk dto
* @return the shenyu result
*/
- @GetMapping("/updateSk")
- public ShenyuAdminResult updateSk(@RequestParam("appKey")
- @Existed(message = "app key not existed",
- provider = AppKeyProvider.class)
final String appKey,
- @RequestParam("appSecret") final String
appSecret) {
- return appAuthService.updateAppSecretByAppKey(appKey, appSecret);
+ @PostMapping("/updateSk")
+ @RequiresPermissions("system:authen:edit")
+ public ShenyuAdminResult updateSk(@Valid @RequestBody final UpdateSkDTO
updateSkDTO) {
+ return appAuthService.updateAppSecretByAppKey(updateSkDTO.getAppKey(),
updateSkDTO.getAppSecret());
}
/**
diff --git
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/SandboxController.java
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/SandboxController.java
index b717df6e6f..a6854eb22a 100755
---
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/SandboxController.java
+++
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/SandboxController.java
@@ -20,6 +20,7 @@ package org.apache.shenyu.admin.controller;
import org.apache.shenyu.admin.aspect.annotation.RestApi;
import org.apache.shenyu.admin.model.dto.ProxyGatewayDTO;
import org.apache.shenyu.admin.service.SandboxService;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
@@ -49,6 +50,7 @@ public class SandboxController {
* @throws IOException throw io exception
*/
@PostMapping(path = "/proxyGateway")
+ @RequiresPermissions("system:authen:modify")
public void proxyGateway(@RequestBody @Valid final ProxyGatewayDTO
proxyGatewayDTO,
final HttpServletRequest request,
final HttpServletResponse response) throws
IOException {
diff --git
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/model/dto/UpdateSkDTO.java
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/model/dto/UpdateSkDTO.java
new file mode 100644
index 0000000000..74d84625c6
--- /dev/null
+++
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/model/dto/UpdateSkDTO.java
@@ -0,0 +1,100 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.shenyu.admin.model.dto;
+
+import org.apache.shenyu.admin.service.provider.AppKeyProvider;
+import org.apache.shenyu.admin.validation.annotation.Existed;
+
+import jakarta.validation.constraints.NotBlank;
+import java.io.Serializable;
+import java.util.Objects;
+
+/**
+ * this is update app secret dto.
+ */
+public class UpdateSkDTO implements Serializable {
+
+ private static final long serialVersionUID = -1L;
+
+ /**
+ * application key.
+ */
+ @NotBlank(message = "app key not null")
+ @Existed(message = "app key not existed", provider = AppKeyProvider.class)
+ private String appKey;
+
+ /**
+ * encryption secret.
+ */
+ @NotBlank(message = "app secret not null")
+ private String appSecret;
+
+ /**
+ * Gets the value of appKey.
+ *
+ * @return the value of appKey
+ */
+ public String getAppKey() {
+ return appKey;
+ }
+
+ /**
+ * Sets the appKey.
+ *
+ * @param appKey appKey
+ */
+ public void setAppKey(final String appKey) {
+ this.appKey = appKey;
+ }
+
+ /**
+ * Gets the value of appSecret.
+ *
+ * @return the value of appSecret
+ */
+ public String getAppSecret() {
+ return appSecret;
+ }
+
+ /**
+ * Sets the appSecret.
+ *
+ * @param appSecret appSecret
+ */
+ public void setAppSecret(final String appSecret) {
+ this.appSecret = appSecret;
+ }
+
+ @Override
+ public boolean equals(final Object o) {
+ if (this == o) {
+ return true;
+ }
+ if (!(o instanceof UpdateSkDTO)) {
+ return false;
+ }
+ UpdateSkDTO that = (UpdateSkDTO) o;
+ return Objects.equals(appKey, that.appKey)
+ && Objects.equals(appSecret, that.appSecret);
+ }
+
+ @Override
+ public int hashCode() {
+ return Objects.hash(appKey, appSecret);
+ }
+}
diff --git
a/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/AppAuthControllerTest.java
b/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/AppAuthControllerTest.java
index 14244f643b..a793f097a8 100644
---
a/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/AppAuthControllerTest.java
+++
b/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/AppAuthControllerTest.java
@@ -27,6 +27,7 @@ import org.apache.shenyu.admin.model.dto.AuthApplyDTO;
import org.apache.shenyu.admin.model.dto.AuthPathDTO;
import org.apache.shenyu.admin.model.dto.AuthPathWarpDTO;
import org.apache.shenyu.admin.model.dto.BatchCommonDTO;
+import org.apache.shenyu.admin.model.dto.UpdateSkDTO;
import org.apache.shenyu.admin.model.page.CommonPager;
import org.apache.shenyu.admin.model.page.PageCondition;
import org.apache.shenyu.admin.model.page.PageParameter;
@@ -36,6 +37,7 @@ import org.apache.shenyu.admin.model.result.ShenyuAdminResult;
import org.apache.shenyu.admin.model.vo.AppAuthVO;
import org.apache.shenyu.admin.model.vo.AuthPathVO;
import org.apache.shenyu.admin.service.AppAuthService;
+import org.apache.shenyu.admin.service.provider.AppKeyProvider;
import org.apache.shenyu.admin.spring.SpringBeanUtils;
import org.apache.shenyu.admin.utils.ShenyuResultMessage;
import org.apache.shenyu.common.constant.AdminConstants;
@@ -186,9 +188,15 @@ public final class AppAuthControllerTest {
@Test
public void testUpdateSk() throws Exception {
- this.mockMvc.perform(MockMvcRequestBuilders.get("/appAuth/updateSk")
- .param("appKey", "testAppKey")
- .param("appSecret", "updateAppSecret"))
+ final UpdateSkDTO updateSkDTO = new UpdateSkDTO();
+ updateSkDTO.setAppKey("testAppKey");
+ updateSkDTO.setAppSecret("updateAppSecret");
+
SpringBeanUtils.getInstance().setApplicationContext(mock(ConfigurableApplicationContext.class));
+
when(SpringBeanUtils.getInstance().getBean(AppKeyProvider.class)).thenReturn(mock(AppKeyProvider.class));
+
when(SpringBeanUtils.getInstance().getBean(AppKeyProvider.class).existed("testAppKey")).thenReturn(true);
+ this.mockMvc.perform(MockMvcRequestBuilders.post("/appAuth/updateSk")
+ .contentType(MediaType.APPLICATION_JSON)
+ .content(GsonUtils.getInstance().toJson(updateSkDTO)))
.andExpect(status().isOk())
.andReturn();
}
