diff --git a/src/proxy.ts b/src/proxy.ts index 153785efdf..b99a0789d9 100644 --- a/src/proxy.ts +++ b/src/proxy.ts @@ -24,6 +24,14 @@ export async function proxy(request: NextRequest) { return runAuthzPipeline(request, { enforce: true }); } +// Next compiles the middleware/proxy matcher from `regexp.source` only, dropping +// path-to-regexp's default case-insensitive flag — so a lowercase literal like +// `/v1/:path*` never matches `/V1/...`, while the rewrite matcher (flag kept) +// still routes it to the handler. That skipped the authz pipeline entirely +// (GHSA-jvqc-mp9f-q936). Expressing the case-insensitivity inside a custom +// path-to-regexp group (`([vV]1)`) survives the flag-drop because it needs no +// flag. Keep these in sync with the client-API aliases in +// next.config.mjs rewrites and src/server/authz/classify.ts. export const config = { matcher: [ "/", @@ -31,15 +39,15 @@ export const config = { "/home", "/home/:path*", "/api/:path*", - "/v1/:path*", - "/v1", - "/v1beta/:path*", - "/v1beta", - "/chat/:path*", - "/responses/:path*", - "/responses", - "/codex/:path*", - "/codex", - "/models", + "/:v1seg([vV]1)/:path*", + "/:v1seg([vV]1)", + "/:v1betaseg([vV]1[bB][eE][tT][aA])/:path*", + "/:v1betaseg([vV]1[bB][eE][tT][aA])", + "/:chatseg([cC][hH][aA][tT])/:path*", + "/:respseg([rR][eE][sS][pP][oO][nN][sS][eE][sS])/:path*", + "/:respseg([rR][eE][sS][pP][oO][nN][sS][eE][sS])", + "/:codexseg([cC][oO][dD][eE][xX])/:path*", + "/:codexseg([cC][oO][dD][eE][xX])", + "/:modelsseg([mM][oO][dD][eE][lL][sS])", ], }; diff --git a/src/server/authz/classify.ts b/src/server/authz/classify.ts index a5270860d6..bfe0f0d6f9 100644 --- a/src/server/authz/classify.ts +++ b/src/server/authz/classify.ts @@ -16,30 +16,39 @@ function normalizePathname(rawPath: string): { path: string; reason?: Classifica if (!path.startsWith("/")) path = "/" + path; if (path.length > 1 && path.endsWith("/")) path = path.slice(0, -1); - if (path === "/codex" || path.startsWith("/codex/")) { + // Client-API aliases are matched case-insensitively on the control segment. + // Next's rewrite layer accepts `/V1/...`, `/CODEX`, etc. and routes them to + // the client handler, so the classifier must recognize the same casing — + // otherwise an uppercase alias falls through to the management fallback and + // the request is treated as a different route class than it is actually + // dispatched to (GHSA-jvqc-mp9f-q936). Only the leading control segment is + // lowercased for detection; the original-case tail is preserved. + const lower = path.toLowerCase(); + + if (lower === "/codex" || lower.startsWith("/codex/")) { return { path: "/api/v1/responses", reason: "client_api_codex_alias" }; } - if (path === "/v1/v1" || path.startsWith("/v1/v1/")) { + if (lower === "/v1/v1" || lower.startsWith("/v1/v1/")) { const tail = path.slice("/v1/v1".length) || ""; return { path: "/api/v1" + tail, reason: "client_api_double_prefix" }; } - if (path === "/v1beta" || path.startsWith("/v1beta/")) { + if (lower === "/v1beta" || lower.startsWith("/v1beta/")) { const tail = path.slice("/v1beta".length) || ""; return { path: "/api/v1beta" + tail, reason: "client_api_alias" }; } - if (path === "/v1" || path.startsWith("/v1/")) { + if (lower === "/v1" || lower.startsWith("/v1/")) { const tail = path.slice("/v1".length) || ""; return { path: "/api/v1" + tail, reason: "client_api_alias" }; } for (const { alias, canonical } of CLIENT_API_ALIAS_PREFIXES) { - if (path === alias) { + if (lower === alias) { return { path: canonical, reason: "client_api_alias" }; } - if (path.startsWith(alias + "/")) { + if (lower.startsWith(alias + "/")) { return { path: canonical + path.slice(alias.length), reason: "client_api_alias" }; } } diff --git a/tests/unit/authz/proxy-contract.test.ts b/tests/unit/authz/proxy-contract.test.ts index 93d44b5852..438eb0f24c 100644 --- a/tests/unit/authz/proxy-contract.test.ts +++ b/tests/unit/authz/proxy-contract.test.ts @@ -55,15 +55,19 @@ test("proxy.ts delegates to runAuthzPipeline with enforce: true", () => { test("proxy.ts config.matcher covers every /api/* route plus dashboard and v1 aliases", () => { const content = fs.readFileSync("src/proxy.ts", "utf8"); // Required prefixes — drop one and the corresponding routes go unguarded. + // The client-API aliases use a case-insensitive path-to-regexp group + // (`([vV]1)`) so `/V1/...` reaches the pipeline too — see + // GHSA-jvqc-mp9f-q936 and tests/unit/authz/proxy-matcher-case.test.ts for the + // semantic (compiled-matcher) coverage assertions. const requiredMatchers = [ '"/api/:path*"', '"/dashboard/:path*"', - '"/v1/:path*"', - '"/v1beta/:path*"', - '"/chat/:path*"', - '"/responses/:path*"', - '"/codex/:path*"', - '"/models"', + '"/:v1seg([vV]1)/:path*"', + '"/:v1betaseg([vV]1[bB][eE][tT][aA])/:path*"', + '"/:chatseg([cC][hH][aA][tT])/:path*"', + '"/:respseg([rR][eE][sS][pP][oO][nN][sS][eE][sS])/:path*"', + '"/:codexseg([cC][oO][dD][eE][xX])/:path*"', + '"/:modelsseg([mM][oO][dD][eE][lL][sS])"', ]; for (const matcher of requiredMatchers) { assert.ok( diff --git a/tests/unit/authz/proxy-matcher-case.test.ts b/tests/unit/authz/proxy-matcher-case.test.ts new file mode 100644 index 0000000000..67c040486c --- /dev/null +++ b/tests/unit/authz/proxy-matcher-case.test.ts @@ -0,0 +1,77 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +// eslint-disable-next-line @typescript-eslint/no-require-imports +import { createRequire } from "node:module"; + +import { config } from "../../../src/proxy.ts"; +import { classifyRoute } from "../../../src/server/authz/classify.ts"; + +// Regression guard — GHSA-jvqc-mp9f-q936 (case-sensitive authz-matcher bypass). +// +// Next.js compiles the middleware/proxy matcher from `regexp.source` only, +// dropping path-to-regexp's default case-insensitive flag, so a lowercase +// literal like `/v1/:path*` does NOT match `/V1/...`. The rewrite matcher keeps +// the flag, so `/V1/chat/completions` was still rewritten to the handler while +// skipping the authz pipeline entirely — an unauthenticated inference bypass. +// +// The fix expresses the case-insensitivity inside a path-to-regexp custom group +// (`/:seg([vV]1)/:path*`), which survives the flag-drop because it needs no +// flag. This test compiles the matcher exactly the way Next does and asserts the +// uppercase / mixed-case client aliases are covered. + +const require = createRequire(import.meta.url); +const { tryToParsePath } = require("next/dist/lib/try-to-parse-path.js"); + +function compiledMatcherRegexes(): RegExp[] { + return (config.matcher as string[]).map((entry) => { + const parsed = tryToParsePath(entry); + // Mirror Next's middleware-route-matcher: source only, no flags. + return new RegExp(parsed.regexStr as string); + }); +} + +function isMatchedByProxy(path: string): boolean { + return compiledMatcherRegexes().some((re) => re.test(path)); +} + +test("proxy matcher still covers the canonical lowercase client aliases", () => { + for (const p of [ + "/v1/chat/completions", + "/v1/models", + "/v1beta/models", + "/responses", + "/codex/x", + "/models", + ]) { + assert.equal(isMatchedByProxy(p), true, `expected proxy matcher to cover ${p}`); + } +}); + +test("proxy matcher covers uppercase / mixed-case client aliases (GHSA-jvqc-mp9f-q936)", () => { + for (const p of [ + "/V1/chat/completions", + "/V1/models", + "/V1BETA/models", + "/CHAT/completions", + "/RESPONSES", + "/CODEX/x", + "/MODELS", + "/Responses/x", + "/v1BeTa/models", + ]) { + assert.equal( + isMatchedByProxy(p), + true, + `uppercase alias ${p} must reach the authz pipeline, not skip it` + ); + } +}); + +test("classifyRoute treats uppercase client aliases as CLIENT_API, not management fallback", () => { + assert.equal(classifyRoute("/V1/chat/completions", "POST").routeClass, "CLIENT_API"); + assert.equal(classifyRoute("/V1BETA/models", "GET").routeClass, "CLIENT_API"); + assert.equal(classifyRoute("/MODELS", "GET").routeClass, "CLIENT_API"); + assert.equal(classifyRoute("/CODEX", "POST").routeClass, "CLIENT_API"); + // Lowercase behavior is unchanged. + assert.equal(classifyRoute("/v1/chat/completions", "POST").routeClass, "CLIENT_API"); +});