mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-20 08:01:35 +00:00
fb2bdc6a53
* fix: add SSRF protection to SAML and MCP OAuth endpoints - Add shared SSRF URL validation utility (windmill-common/ssrf.rs) that blocks private/loopback/link-local IPs and validates DNS resolution - Move test_metadata to authed service requiring superadmin access - Strip response body from SAML metadata parsing errors - Add SSRF blocklist to MCP OAuth discover, start, and client registration endpoints Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref.txt for SSRF fix Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref.txt Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 563877bf1c8b4184f638bab51be89b1c0aec6dad This commit updates the EE repository reference after PR #471 was merged in windmill-ee-private. Previous ee-repo-ref: a600fe1807ea267f87a57360f4b48bf917776723 New ee-repo-ref: 563877bf1c8b4184f638bab51be89b1c0aec6dad Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
40 lines
1.0 KiB
Rust
40 lines
1.0 KiB
Rust
/*
|
|
* Author: Ruben Fiszel
|
|
* Copyright: Windmill Labs, Inc 2023
|
|
* This file and its contents are licensed under the AGPLv3 License.
|
|
* Please see the included NOTICE for copyright information and
|
|
* LICENSE-AGPL for a copy of the license.
|
|
*/
|
|
#![allow(non_snake_case)]
|
|
|
|
#[cfg(feature = "private")]
|
|
#[allow(unused)]
|
|
pub use crate::saml_ee::*;
|
|
|
|
#[cfg(not(feature = "private"))]
|
|
use axum::{routing::post, Router};
|
|
|
|
#[cfg(not(feature = "private"))]
|
|
pub struct ServiceProviderExt();
|
|
|
|
#[cfg(not(feature = "private"))]
|
|
pub async fn build_sp_extension() -> anyhow::Result<ServiceProviderExt> {
|
|
return Ok(ServiceProviderExt());
|
|
}
|
|
|
|
#[cfg(not(feature = "private"))]
|
|
pub fn global_service() -> Router {
|
|
Router::new().route("/acs", post(acs))
|
|
}
|
|
|
|
#[cfg(not(feature = "private"))]
|
|
pub fn authed_service() -> Router {
|
|
Router::new()
|
|
}
|
|
|
|
#[cfg(not(feature = "private"))]
|
|
pub async fn acs() -> String {
|
|
// Implementation is not open source as it is a Windmill Enterprise Edition feature
|
|
"SAML available only in enterprise version".to_string()
|
|
}
|