refactor(core): Use consistent CSRF state validation across oAuth controllers (#9104)

Co-authored-by: Danny Martini <danny@n8n.io>

packages/cli/test/unit/controllers/oauth/oAuth1Credential.controller.test.ts

@@ -1,10 +1,12 @@
 import nock from 'nock';
 import Container from 'typedi';
+import type { Response } from 'express';
+import Csrf from 'csrf';
 import { Cipher } from 'n8n-core';
 import { mock } from 'jest-mock-extended';
 
 import { OAuth1CredentialController } from '@/controllers/oauth/oAuth1Credential.controller';
-import type { CredentialsEntity } from '@db/entities/CredentialsEntity';
+import { CredentialsEntity } from '@db/entities/CredentialsEntity';
 import type { User } from '@db/entities/User';
 import type { OAuthRequest } from '@/requests';
 import { CredentialsRepository } from '@db/repositories/credentials.repository';
@@ -14,11 +16,11 @@ import { Logger } from '@/Logger';
 import { VariablesService } from '@/environments/variables/variables.service.ee';
 import { SecretsHelper } from '@/SecretsHelpers';
 import { CredentialsHelper } from '@/CredentialsHelper';
-
-import { mockInstance } from '../../shared/mocking';
 import { BadRequestError } from '@/errors/response-errors/bad-request.error';
 import { NotFoundError } from '@/errors/response-errors/not-found.error';
 
+import { mockInstance } from '../../../shared/mocking';
+
 describe('OAuth1CredentialController', () => {
 	mockInstance(Logger);
 	mockInstance(ExternalHooks);
@@ -30,6 +32,8 @@ describe('OAuth1CredentialController', () => {
 	const credentialsHelper = mockInstance(CredentialsHelper);
 	const credentialsRepository = mockInstance(CredentialsRepository);
 	const sharedCredentialsRepository = mockInstance(SharedCredentialsRepository);
+
+	const csrfSecret = 'csrf-secret';
 	const user = mock<User>({
 		id: '123',
 		password: 'password',
@@ -66,6 +70,8 @@ describe('OAuth1CredentialController', () => {
 		});
 
 		it('should return a valid auth URI', async () => {
+			jest.spyOn(Csrf.prototype, 'secretSync').mockReturnValueOnce(csrfSecret);
+			jest.spyOn(Csrf.prototype, 'create').mockReturnValueOnce('token');
 			sharedCredentialsRepository.findCredentialForUser.mockResolvedValueOnce(credential);
 			credentialsHelper.getDecrypted.mockResolvedValueOnce({});
 			credentialsHelper.applyDefaultsAndOverwrites.mockReturnValueOnce({
@@ -75,7 +81,8 @@ describe('OAuth1CredentialController', () => {
 			});
 			nock('https://example.domain')
 				.post('/oauth/request_token', {
-					oauth_callback: 'http://localhost:5678/rest/oauth1-credential/callback?cid=1',
+					oauth_callback:
+						'http://localhost:5678/rest/oauth1-credential/callback?state=eyJ0b2tlbiI6InRva2VuIiwiY2lkIjoiMSJ9',
 				})
 				.reply(200, { oauth_token: 'random-token' });
 			cipher.encrypt.mockReturnValue('encrypted');
@@ -92,6 +99,91 @@ describe('OAuth1CredentialController', () => {
 					type: 'oAuth1Api',
 				}),
 			);
+			expect(cipher.encrypt).toHaveBeenCalledWith({ csrfSecret });
+		});
+	});
+
+	describe('handleCallback', () => {
+		const validState = Buffer.from(
+			JSON.stringify({
+				token: 'token',
+				cid: '1',
+			}),
+		).toString('base64');
+
+		it('should render the error page when required query params are missing', async () => {
+			const req = mock<OAuthRequest.OAuth1Credential.Callback>();
+			const res = mock<Response>();
+			req.query = { state: 'test' } as OAuthRequest.OAuth1Credential.Callback['query'];
+			await controller.handleCallback(req, res);
+
+			expect(res.render).toHaveBeenCalledWith('oauth-error-callback', {
+				error: {
+					message: 'Insufficient parameters for OAuth1 callback.',
+					reason: 'Received following query parameters: {"state":"test"}',
+				},
+			});
+			expect(credentialsRepository.findOneBy).not.toHaveBeenCalled();
+		});
+
+		it('should render the error page when `state` query param is invalid', async () => {
+			const req = mock<OAuthRequest.OAuth1Credential.Callback>();
+			const res = mock<Response>();
+			req.query = {
+				oauth_verifier: 'verifier',
+				oauth_token: 'token',
+				state: 'test',
+			} as OAuthRequest.OAuth1Credential.Callback['query'];
+			await controller.handleCallback(req, res);
+
+			expect(res.render).toHaveBeenCalledWith('oauth-error-callback', {
+				error: {
+					message: 'Invalid state format',
+				},
+			});
+			expect(credentialsRepository.findOneBy).not.toHaveBeenCalled();
+		});
+
+		it('should render the error page when credential is not found in DB', async () => {
+			credentialsRepository.findOneBy.mockResolvedValueOnce(null);
+
+			const req = mock<OAuthRequest.OAuth1Credential.Callback>();
+			const res = mock<Response>();
+			req.query = {
+				oauth_verifier: 'verifier',
+				oauth_token: 'token',
+				state: validState,
+			} as OAuthRequest.OAuth1Credential.Callback['query'];
+			await controller.handleCallback(req, res);
+
+			expect(res.render).toHaveBeenCalledWith('oauth-error-callback', {
+				error: {
+					message: 'OAuth1 callback failed because of insufficient permissions',
+				},
+			});
+			expect(credentialsRepository.findOneBy).toHaveBeenCalledTimes(1);
+			expect(credentialsRepository.findOneBy).toHaveBeenCalledWith({ id: '1' });
+		});
+
+		it('should render the error page when state differs from the stored state in the credential', async () => {
+			credentialsRepository.findOneBy.mockResolvedValue(new CredentialsEntity());
+			credentialsHelper.getDecrypted.mockResolvedValue({ csrfSecret: 'invalid' });
+
+			const req = mock<OAuthRequest.OAuth1Credential.Callback>();
+			const res = mock<Response>();
+			req.query = {
+				oauth_verifier: 'verifier',
+				oauth_token: 'token',
+				state: validState,
+			} as OAuthRequest.OAuth1Credential.Callback['query'];
+
+			await controller.handleCallback(req, res);
+
+			expect(res.render).toHaveBeenCalledWith('oauth-error-callback', {
+				error: {
+					message: 'The OAuth1 callback state is invalid!',
+				},
+			});
 		});
 	});
 });

packages/cli/test/unit/controllers/oauth/oAuth2Credential.controller.test.ts

@@ -16,11 +16,11 @@ import { Logger } from '@/Logger';
 import { VariablesService } from '@/environments/variables/variables.service.ee';
 import { SecretsHelper } from '@/SecretsHelpers';
 import { CredentialsHelper } from '@/CredentialsHelper';
-
-import { mockInstance } from '../../shared/mocking';
 import { BadRequestError } from '@/errors/response-errors/bad-request.error';
 import { NotFoundError } from '@/errors/response-errors/not-found.error';
 
+import { mockInstance } from '../../../shared/mocking';
+
 describe('OAuth2CredentialController', () => {
 	mockInstance(Logger);
 	mockInstance(SecretsHelper);