From 3bd94c483d1e51dc075b1fe1d86b50c36a218b66 Mon Sep 17 00:00:00 2001 From: GandC Date: Wed, 16 Sep 2026 22:05:05 +0300 Subject: [PATCH] fix sso login failure 2 --- .gitea/workflows/desktop.yml | 140 ++++++++--------------------------- 1 file changed, 32 insertions(+), 108 deletions(-) diff --git a/.gitea/workflows/desktop.yml b/.gitea/workflows/desktop.yml index 948b408..c0a5e59 100644 --- a/.gitea/workflows/desktop.yml +++ b/.gitea/workflows/desktop.yml @@ -161,63 +161,25 @@ jobs: $NavigationPattern = "webContents\.on\('will-navigate', \(event, url\) => \{\r?\n\s*if \(!isTrustedOrigin\(url\)\) \{\r?\n\s*event\.preventDefault\(\);\r?\n\s*\}\r?\n\s*\}\);" $NavigationReplacementLines = @( - "let externalSsoNavigationActive = false;" + "const isAllowedSsoOrigin = (url: string): boolean => {" + "`ttry {" + "`t`treturn new URL(url).origin === 'https://sso.gandc.ru';" + "`t} catch {" + "`t`treturn false;" + "`t}" + "};" "" - "`twebContents.on('will-navigate', (event, url) => {" - "`t`tif (isTrustedOrigin(url)) {" - "`t`t`tif (externalSsoNavigationActive) {" - "`t`t`t`tlogger.info('SSO navigation returned to trusted origin', {url});" - "`t`t`t}" - "`t`t`texternalSsoNavigationActive = false;" + "`tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {" + "`t`tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {" "`t`t`treturn;" "`t`t}" "" - "`t`ttry {" - "`t`t`tconst target = new URL(url);" - "" - "`t`t`tif (externalSsoNavigationActive) {" - "`t`t`t`tif (target.protocol === 'https:' || target.protocol === 'http:') {" - "`t`t`t`t`tlogger.info('Allowing active SSO navigation', {" - "`t`t`t`t`t`torigin: target.origin," - "`t`t`t`t`t});" - "`t`t`t`t`treturn;" - "`t`t`t`t}" - "" - "`t`t`t`tlogger.warn('Blocked non-HTTP navigation during SSO', {" - "`t`t`t`t`turl," - "`t`t`t`t});" - "`t`t`t`tevent.preventDefault();" - "`t`t`t`treturn;" - "`t`t`t}" - "" - "`t`t`tconst isKeycloakAuthorization =" - "`t`t`t`ttarget.protocol === 'https:' &&" - "`t`t`t`ttarget.pathname.includes('/protocol/openid-connect/auth') &&" - "`t`t`t`ttarget.searchParams.has('client_id') &&" - "`t`t`t`ttarget.searchParams.has('redirect_uri') &&" - "`t`t`t`ttarget.searchParams.has('state');" - "" - "`t`t`tif (" - "`t`t`t`tisKeycloakAuthorization &&" - "`t`t`t`tisTrustedOrigin(webContents.getURL())" - "`t`t`t) {" - "`t`t`t`texternalSsoNavigationActive = true;" - "" - "`t`t`t`tlogger.info('Allowing Keycloak SSO navigation', {" - "`t`t`t`t`torigin: target.origin," - "`t`t`t`t});" - "" - "`t`t`t`treturn;" - "`t`t`t}" - "`t`t} catch (error) {" - "`t`t`tlogger.warn('Failed to parse navigation URL', {" - "`t`t`t`turl," - "`t`t`t`terror," - "`t`t`t});" - "`t`t}" - "" + "`t`tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});" "`t`tevent.preventDefault();" - "`t});" + "`t};" + "" + "`twebContents.on('will-navigate', allowTrustedOrSsoNavigation);" + "`twebContents.on('will-redirect', allowTrustedOrSsoNavigation);" ) $NavigationReplacement = $NavigationReplacementLines -join "`n" @@ -239,11 +201,11 @@ jobs: -NoNewline ` -Encoding utf8 - Write-Host "SSO navigation patch applied" + Write-Host "SSO navigation allowlist patch applied" Select-String ` -Path $WindowPath ` - -Pattern "externalSsoNavigationActive|Allowing Keycloak SSO navigation" + -Pattern "sso.gandc.ru|will-redirect|allowTrustedOrSsoNavigation" - name: Install dependencies @@ -683,63 +645,25 @@ jobs: ) replacement = "\n".join([ - "let externalSsoNavigationActive = false;", + "const isAllowedSsoOrigin = (url: string): boolean => {", + "\ttry {", + "\t\treturn new URL(url).origin === 'https://sso.gandc.ru';", + "\t} catch {", + "\t\treturn false;", + "\t}", + "};", "", - "\twebContents.on('will-navigate', (event, url) => {", - "\t\tif (isTrustedOrigin(url)) {", - "\t\t\tif (externalSsoNavigationActive) {", - "\t\t\t\tlogger.info('SSO navigation returned to trusted origin', {url});", - "\t\t\t}", - "\t\t\texternalSsoNavigationActive = false;", + "\tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {", + "\t\tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {", "\t\t\treturn;", "\t\t}", "", - "\t\ttry {", - "\t\t\tconst target = new URL(url);", - "", - "\t\t\tif (externalSsoNavigationActive) {", - "\t\t\t\tif (target.protocol === 'https:' || target.protocol === 'http:') {", - "\t\t\t\t\tlogger.info('Allowing active SSO navigation', {", - "\t\t\t\t\t\torigin: target.origin,", - "\t\t\t\t\t});", - "\t\t\t\t\treturn;", - "\t\t\t\t}", - "", - "\t\t\t\tlogger.warn('Blocked non-HTTP navigation during SSO', {", - "\t\t\t\t\turl,", - "\t\t\t\t});", - "\t\t\t\tevent.preventDefault();", - "\t\t\t\treturn;", - "\t\t\t}", - "", - "\t\t\tconst isKeycloakAuthorization =", - "\t\t\t\ttarget.protocol === 'https:' &&", - "\t\t\t\ttarget.pathname.includes('/protocol/openid-connect/auth') &&", - "\t\t\t\ttarget.searchParams.has('client_id') &&", - "\t\t\t\ttarget.searchParams.has('redirect_uri') &&", - "\t\t\t\ttarget.searchParams.has('state');", - "", - "\t\t\tif (", - "\t\t\t\tisKeycloakAuthorization &&", - "\t\t\t\tisTrustedOrigin(webContents.getURL())", - "\t\t\t) {", - "\t\t\t\texternalSsoNavigationActive = true;", - "", - "\t\t\t\tlogger.info('Allowing Keycloak SSO navigation', {", - "\t\t\t\t\torigin: target.origin,", - "\t\t\t\t});", - "", - "\t\t\t\treturn;", - "\t\t\t}", - "\t\t} catch (error) {", - "\t\t\tlogger.warn('Failed to parse navigation URL', {", - "\t\t\t\turl,", - "\t\t\t\terror,", - "\t\t\t});", - "\t\t}", - "", + "\t\tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});", "\t\tevent.preventDefault();", - "\t});", + "\t};", + "", + "\twebContents.on('will-navigate', allowTrustedOrSsoNavigation);", + "\twebContents.on('will-redirect', allowTrustedOrSsoNavigation);", ]) data, count = pattern.subn( @@ -758,11 +682,11 @@ jobs: encoding="utf-8", ) - print("SSO navigation patch applied") + print("SSO navigation allowlist patch applied") PY grep -n \ - -E 'externalSsoNavigationActive|Allowing Keycloak SSO navigation' \ + -E 'sso\.gandc\.ru|will-redirect|allowTrustedOrSsoNavigation' \ fluxer-src/fluxer_desktop/src/main/Window.ts