Files
windmill/backend/windmill-api/src/saml_oss.rs
T
Ruben Fiszel fb2bdc6a53 SSRF protection for SAML and MCP OAuth endpoints (#8473)
* fix: add SSRF protection to SAML and MCP OAuth endpoints

- Add shared SSRF URL validation utility (windmill-common/ssrf.rs) that blocks private/loopback/link-local IPs and validates DNS resolution
- Move test_metadata to authed service requiring superadmin access
- Strip response body from SAML metadata parsing errors
- Add SSRF blocklist to MCP OAuth discover, start, and client registration endpoints

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref.txt for SSRF fix

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref.txt

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 563877bf1c8b4184f638bab51be89b1c0aec6dad

This commit updates the EE repository reference after PR #471 was merged in windmill-ee-private.

Previous ee-repo-ref: a600fe1807ea267f87a57360f4b48bf917776723

New ee-repo-ref: 563877bf1c8b4184f638bab51be89b1c0aec6dad

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
2026-03-22 17:18:22 +00:00

40 lines
1.0 KiB
Rust

/*
* Author: Ruben Fiszel
* Copyright: Windmill Labs, Inc 2023
* This file and its contents are licensed under the AGPLv3 License.
* Please see the included NOTICE for copyright information and
* LICENSE-AGPL for a copy of the license.
*/
#![allow(non_snake_case)]
#[cfg(feature = "private")]
#[allow(unused)]
pub use crate::saml_ee::*;
#[cfg(not(feature = "private"))]
use axum::{routing::post, Router};
#[cfg(not(feature = "private"))]
pub struct ServiceProviderExt();
#[cfg(not(feature = "private"))]
pub async fn build_sp_extension() -> anyhow::Result<ServiceProviderExt> {
return Ok(ServiceProviderExt());
}
#[cfg(not(feature = "private"))]
pub fn global_service() -> Router {
Router::new().route("/acs", post(acs))
}
#[cfg(not(feature = "private"))]
pub fn authed_service() -> Router {
Router::new()
}
#[cfg(not(feature = "private"))]
pub async fn acs() -> String {
// Implementation is not open source as it is a Windmill Enterprise Edition feature
"SAML available only in enterprise version".to_string()
}