From 9cb67bfb8775b2bdbff00a0763bbd3a4c307110a Mon Sep 17 00:00:00 2001
From: Jonathan Perret <j-github@jonathanperret.net>
Date: Wed, 5 Mar 2025 16:51:42 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F(nginx)=20add=20basic=20pa?=
 =?UTF-8?q?th=20allowlist?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This should cut down on opportunistic attack attempts, which are more
a nuisance than anything right now but it can't hurt to stop them
earlier.
---
 CHANGELOG.md                             |  3 +++
 src/helm/oidc2fer/templates/ingress.yaml | 11 +++++++----
 src/helm/oidc2fer/values.yaml            |  7 ++++++-
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f09994..c23835a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+- add allowlist for URL paths to nginx ingress
+
 ## [1.0.4] - 2024-09-11
 - serve static files
 
diff --git a/src/helm/oidc2fer/templates/ingress.yaml b/src/helm/oidc2fer/templates/ingress.yaml
index 6eeb292..82c2471 100644
--- a/src/helm/oidc2fer/templates/ingress.yaml
+++ b/src/helm/oidc2fer/templates/ingress.yaml
@@ -1,5 +1,6 @@
 {{- if .Values.ingress.enabled -}}
 {{- $fullName := include "oidc2fer.fullname" . -}}
+{{- $port := .Values.satosa.service.port -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -33,13 +34,15 @@ spec:
     - host: {{ .Values.ingress.host | quote }}
       http:
         paths:
-          - path: /
-            pathType: Prefix
+          {{- range .Values.ingress.paths }}
+          - path: {{ .path | quote }}
+            pathType: {{ .pathType }}
             backend:
               service:
-                name: {{ include "oidc2fer.satosa.fullname" . }}
+                name: {{ $fullName }}-satosa
                 port:
-                  number: {{ .Values.satosa.service.port }}
+                  number: {{ $port }}
+          {{- end }}
           {{- with .Values.ingress.customBackends }}
             {{- toYaml . | nindent 10 }}
           {{- end }}
diff --git a/src/helm/oidc2fer/values.yaml b/src/helm/oidc2fer/values.yaml
index 39a8b19..27e1fa9 100644
--- a/src/helm/oidc2fer/values.yaml
+++ b/src/helm/oidc2fer/values.yaml
@@ -33,7 +33,9 @@ ingress:
   enabled: false
   className: null
   host: oidc2fer.example.com
-  path: /
+  paths:
+  - path: '/$|^/\.well-known/openid-configuration$|^/images/|^/Saml2/|^/OIDC/|^/ping$'
+    pathType: ImplementationSpecific # enables regex matching
   ## @param ingress.hosts Additional host to configure for the Ingress
   hosts: []
   #  - chart-example.local
@@ -48,6 +50,9 @@ ingress:
   ## @param ingress.customBackends Add custom backends to ingress
   customBackends: []
 
+  annotations:
+    nginx.ingress.kubernetes.io/use-regex: "true"
+
 ## @section satosa
 
 satosa: