Repository navigation
fix: validate objectType and encode path params in managed-object tools (IAM-11741) - #72
Merged
daveernstingFR merged 1 commit intoOct 19, 2026
Conversation
…ls (IAM-11741) Managed-object tools interpolated the `objectType` argument into outbound IDM URLs with only a non-empty-string check. Because the WHATWG URL parser normalizes `../` segments and treats `?`/`#` as delimiters before a request is sent, a crafted value could redirect these privileged `fr:idm:*` calls to arbitrary IDM endpoints (e.g. `/openidm/config/*`). Two-layer fix: - Boundary: shared `managedObjectTypeSchema` allowlist (`^[a-zA-Z0-9_]+$`, the character set documented for managed object type keys) applied to `objectType` in create/get/delete/patch/query/getManagedObjectSchema. - Sink: `encodeURIComponent` on `objectType` at all five URL construction sites and on `objectId` at the three two-param sites, so encoding holds even for inputs that reach a tool without MCP-level validation. Also regenerates the six affected tool-schema snapshots and hardens the objectType tests to assert traversal/delimiter payloads are rejected, plus a regression test asserting the request path stays under /openidm/managed/ for an encoded traversal payload. Gates: lint, format:check, typecheck, build, and the full vitest suite (1264 tests) all pass. Co-Authored-By: Claude Code <noreply@anthropic.com>
daveernstingFR
force-pushed
the
polaris/IAM-11741-fix-objecttype-path-traversal
branch
from
October 19, 2026 09:45
0eb711f to
da4b38e
Compare
daveernstingFR
deleted the
polaris/IAM-11741-fix-objecttype-path-traversal
branch
October 19, 2026 09:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes a path-traversal vulnerability in the managed-object tools (IAM-11741). The
objectTypeargument was validated only as a non-empty string and interpolated raw into privileged outbound IDM URLs. Node's WHATWG URL parser normalizes../dot segments before sending and treats?/#as URL delimiters, so a caller holding only identity scopes could retarget the server's privilegedfr:idm:*admin token at any IDM endpoint — including/openidm/config/*(tenant-wide configuration: SMTP credentials, script hooks, connector configs). Verified locally: raw interpolation ofalpha_user/../../config/syncresolves to/openidm/config/sync.The fix applies two defense layers:
managedObjectTypeSchema(^[a-zA-Z0-9_]+$) insrc/utils/managedObjectHelpers.ts, adopted by all six affected tools. Regex verified against official Ping documentation: the AIC admin console restricts object type keys toa-z A-Z 0-9; the legacy native console adds_; the repo's definition tools already enforce the identical regex;internal/roleis a separate endpoint, not a managed object type.encodeURIComponentonobjectTypeat all five URL construction sites and onobjectIdat the three two-param sites.new URL(...)alone does not protect (template interpolation happens before WHATWG normalization), so the encoding is what neutralizes traversal.Tools covered:
createManagedObject,getManagedObject,deleteManagedObject,patchManagedObject,queryManagedObjects(the five from the ticket) plusgetManagedObjectSchema(same weak schema, constant URL, added for consistency).patchManagedObjectRelationshipalready usedsafePathSegmentSchemaand is untouched. No changes to shared helpers (apiHelpers.ts,validationHelpers.tsuntouched).🤖 Generated with Claude Code
Test plan
../config/,alpha_user/../../config/sync,%2e%2e,a?b,a#b,'') at the MCP validation layer — Verified by Polaris QA (drove the realMcpServeroverInMemoryTransport: every payload returns-32602input validation,toolFunctionnever executes)toolFunctioncalls on the built dist resolve every payload to a path under/openidm/managed/, e.g...%2Fconfig%2Fsync; regression test added and mutation-verified)alpha_user,obj-123,alpha_devicepass unmodified; full suite 1264 tests green)_def.checks:min→regex) — Verified by Polaris QAapiHelpers.ts,validationHelpers.ts,patchManagedObjectRelationship.tsuntouched — Verified by Polaris QAnpm run lint,npm run format:check,npm run typecheck,npm test,npm run buildall pass — Verified by Polaris QAFixes IAM-11741.