Sharon Katz
d9426402b2
**Related issue:** Resolves fleetdm/confidential#16883 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Summary Normalized LocURI target values before validation checks in Windows MDM profile handling. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually - [x] Confirmed that the fix is not expected to adversely impact load test results ### Reproduction Wrote test cases that construct Windows SCEP profile XML with trailing whitespace appended to LocURI paths (e.g., `/Install/SubjectName ` with a trailing space). Before the fix, these profiles passed validation without the required renewal-id marker because `strings.HasSuffix` did not match the whitespace-suffixed path. The same bypass applied to Challenge and ServerURL LocURIs. ### Unit tests added 7 new test cases across two test functions: **`TestAdditionalNDESValidationForWindowsProfiles`** (3 new cases): - SubjectName LocURI with trailing whitespace is still validated for renewal id - Challenge LocURI with trailing whitespace still validates correctly - ServerURL LocURI with trailing whitespace still validates correctly **`TestAdditionalCustomSCEPValidationForWindowsProfiles`** (new function, 4 cases): - Valid custom SCEP profile passes - SubjectName missing renewal id is rejected - SubjectName with trailing whitespace in LocURI is still validated for renewal id - SubjectName with internal whitespace (not trailing) is rejected ### Local verification 1. Wrote failing tests first, confirmed the whitespace bypass existed (tests failed as expected before the fix) 2. Applied the fix (`strings.TrimSpace` on target before `HasSuffix` checks) 3. Confirmed all new tests pass after the fix 4. Ran full test suite: `go test ./server/service/ -run "TestAdditionalNDESValidation|TestAdditionalCustomSCEPValidation" -v` with all 14 tests passing 5. Ran `make lint-go-incremental` with 0 issues
2 lines
72 B
Plaintext
2 lines
72 B
Plaintext
Normalized LocURI values before validation in Windows profile handling.
|