adam/orchestrator
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security-review): confluence-doc cloudId via accessible-resources #41

Merged
amoussa1229 merged 1 commit from fix/confluence-doc-cloudid-accessible-resources into main 2026-06-22 23:47:38 +00:00
Conversation 0 Commits 1 Files changed 1 +14 -9
1 changed files with 14 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
security-review/checkers/confluence-doc.sh
View file

@ -221,15 +221,8 @@ _CONF_MODE=""; _CONF_BASE=""; _CONF_BEARER=""
conf_api_init() {
if [ -n "$CONFLUENCE_OAUTH_CLIENT_ID" ] && [ -n "$CONFLUENCE_OAUTH_CLIENT_SECRET" ]; then
local cid="$CONFLUENCE_CLOUD_ID"
if [ -z "$cid" ] && [ -n "$CONFLUENCE_BASE_URL" ]; then
cid="$(curl -sS -H 'Accept: application/json' \
"$CONFLUENCE_BASE_URL/_edge/tenant_info" 2>>"$REPORT_DIR/confluence-api.log" \
| jq -r '.cloudId // empty' 2>/dev/null)"
fi
[ -n "$cid" ] || { log "OAuth: could not resolve cloudId — skipping API"; return 1; }
# 2LO client-credentials token. The secret goes in the request BODY via
# --data-urlencode and is never echoed/logged (matches the existing -u risk class).
# 2LO client-credentials token FIRST (the secret goes in the request BODY via
# --data-urlencode and is never echoed/logged — matches the existing -u risk class).
local tok
tok="$(curl -sS -X POST "$CONFLUENCE_OAUTH_TOKEN_URL" \
-H 'Content-Type: application/x-www-form-urlencoded' \
@ -238,6 +231,18 @@ conf_api_init() {
--data-urlencode 'grant_type=client_credentials' \
2>>"$REPORT_DIR/confluence-api.log" | jq -r '.access_token // empty' 2>/dev/null)"
[ -n "$tok" ] || { log "OAuth: token request failed — skipping API (no false alarm)"; return 1; }
# Resolve the cloudId: use CONFLUENCE_CLOUD_ID if given, else the OAuth-native
# accessible-resources endpoint (the public /_edge/tenant_info is not reliable).
# Prefer the resource whose url matches the configured site; else the first.
local cid="$CONFLUENCE_CLOUD_ID"
if [ -z "$cid" ]; then
cid="$(curl -sS -H "Authorization: Bearer $tok" -H 'Accept: application/json' \
'https://api.atlassian.com/oauth/token/accessible-resources' \
2>>"$REPORT_DIR/confluence-api.log" \
| jq -r --arg url "$CONFLUENCE_BASE_URL" \
'(map(select(.url==$url)) | .[0].id) // .[0].id // empty' 2>/dev/null)"
fi
[ -n "$cid" ] || { log "OAuth: could not resolve cloudId (set CONFLUENCE_CLOUD_ID) — skipping API"; return 1; }
_CONF_MODE="oauth"; _CONF_BEARER="$tok"
_CONF_BASE="https://api.atlassian.com/ex/confluence/$cid"
return 0