auth

Oct 10, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Sep 19, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Sep 17, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Sep 2, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Aug 28, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Aug 22, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Aug 21, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Aug 6, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Jul 31, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Jul 18, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Jul 15, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Changes in this version

type Identity

+ FirstName string

+ LastName string

Jul 9, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Jun 26, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

Changes in this version

+ func GetUserEmailFromContext(ctx context.Context) (string, error)

+ func GetUserTokenFromContext(ctx context.Context) (openid.Token, error)

Jun 13, 2024 GO-2024-2582

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

May 27, 2024 GO-2024-2582 +1 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

May 20, 2024 GO-2024-2582 +2 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

May 16, 2024 GO-2024-2582 +3 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

May 7, 2024 GO-2024-2582 +4 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Changes in this version

+ type Identity struct

+ HumanName string

+ Provider IdentityProvider

+ UserID string

+ func (i *Identity) Human() string

+ func (i *Identity) String() string

+ type IdentityClient struct

+ func NewIdentityClient(providers ...IdentityProvider) (*IdentityClient, error)

+ func (c *IdentityClient) Register(p IdentityProvider) error

+ func (c *IdentityClient) Resolve(ctx context.Context, id string) (*Identity, error)

+ func (c *IdentityClient) Validate(ctx context.Context, token jwt.Token) (*Identity, error)

+ type IdentityProvider interface

+ String func() string

+ URL func() url.URL

+ type Resolver interface

+ Resolve func(ctx context.Context, id string) (*Identity, error)

+ Validate func(ctx context.Context, token jwt.Token) (*Identity, error)

Apr 16, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Apr 12, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Apr 12, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Apr 11, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Apr 11, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Apr 9, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Apr 8, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Apr 5, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Apr 4, 2024 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2701: Minder GetRepositoryByName data leak in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Changes in this version

+ func GetUserForGitHubId(ctx context.Context, sic server.IdentityConfigWrapper, ghUser int64) (string, error)

Mar 28, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Mar 22, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Changes in this version

+ const GitHubApp

Mar 19, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Mar 13, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Changes in this version

+ func GetUserClaimFromContext[T any](ctx context.Context, claim string) (T, bool)

+ func WithAuthTokenContext(ctx context.Context, token openid.Token) context.Context

Mar 5, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Mar 5, 2024 GO-2024-2582 +5 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Mar 4, 2024 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Feb 26, 2024 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Feb 9, 2024 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Feb 9, 2024 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Feb 2, 2024 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Jan 25, 2024 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Jan 17, 2024 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Jan 16, 2024 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Jan 11, 2024 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Changes in this version

+ func GetUserSubjectFromContext(ctx context.Context) string

+ func WithUserSubjectContext(ctx context.Context, subject string) context.Context

Dec 22, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Dec 21, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Dec 14, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Dec 8, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Nov 28, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Nov 20, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Nov 16, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Nov 15, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Nov 9, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Nov 6, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Nov 6, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Nov 5, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Nov 4, 2023 GO-2024-2582 +6 more

  GO-2024-2582: Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder

  GO-2024-2608: Minder access control bypass in github.com/stacklok/minder

  GO-2024-2821: Denial of Service from untrusted requests in github.com/stacklok/minder

  GO-2024-2864: Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder

  GO-2024-2871: Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

  GO-2024-2885: Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

  GO-2024-2934: Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Changes in this version

+ const Github

+ const Google

+ var OAuthSuccessHtml []byte

+ func DeleteAccessToken(ctx context.Context, provider string, token string) error

+ func GetDefaultProject(ctx context.Context) (uuid.UUID, error)

+ func GetUserProjects(ctx context.Context) ([]uuid.UUID, error)

+ func IsAuthorizedForProject(ctx context.Context, projectID uuid.UUID) bool

+ func NewOAuthConfig(provider string, cli bool) (*oauth2.Config, error)

+ func NewProviderHttpClient(provider string) *http.Client

+ func RegisterOAuthFlags(v *viper.Viper, flags *pflag.FlagSet) error

+ func ValidateProviderToken(_ context.Context, provider string, token string) error

+ func WithPermissionsContext(ctx context.Context, claims UserPermissions) context.Context

+ type JwkSetJwtValidator struct

+ func (j *JwkSetJwtValidator) ParseAndValidate(tokenString string) (openid.Token, error)

+ type JwtValidator interface

+ ParseAndValidate func(tokenString string) (openid.Token, error)

+ func NewJwtValidator(ctx context.Context, jwksUrl string) (JwtValidator, error)

+ type KeySetCache struct

+ func (k *KeySetCache) GetKeySet() (jwk.Set, error)

+ type KeySetFetcher interface

+ GetKeySet func() (jwk.Set, error)

+ type RoleInfo struct

+ IsAdmin bool

+ OrganizationID uuid.UUID

+ ProjectID *uuid.UUID

+ RoleID int32

+ type UserDetails struct

+ Email string

+ Name string

+ func GetUserDetails(ctx context.Context, cmd *cobra.Command, v *viper.Viper) (*UserDetails, error)

+ type UserPermissions struct

+ IsStaff bool

+ OrganizationId uuid.UUID

+ ProjectIds []uuid.UUID

+ Roles []RoleInfo

+ UserId int32

+ func GetPermissionsFromContext(ctx context.Context) UserPermissions