immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 12 Packages Projects Releases 10 Wiki Activity

[BUG] Storage label allows '.' from oidc #1127

New Issue
Closed
opened 2026-02-05 00:33:36 +03:00 by OVERLORD · 2 comments
OVERLORD commented 2026-02-05 00:33:36 +03:00
Owner
Copy Link

Originally created by @pixil98 on GitHub (Jul 20, 2023).

The bug

When using the new functionality to set a storage label from a claim when using oauth, the claim seems to be taken without sanitation. In my setup the preferred_username is an email address so it has a . in it.

image

If I try to set the same storage label manually, the . is stripped out when it is saved. I assume it's stripped out for a reason, but either way it would be good to be consistent.

The OS that Immich Server is running on

Debian

Version of Immich Server

v1.68.0

Version of Immich Mobile App

N/A

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

apiVersion: apps/v1
kind: Deployment
metadata:
  name: authentik-server
  namespace: auth
  labels:
    app.kubernetes.io/name: server
    app.kubernetes.io/instance: authentik
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: server
      app.kubernetes.io/instance: authentik
  template:
    metadata:
      labels:
        app.kubernetes.io/name: server
        app.kubernetes.io/instance: authentik
    spec:
      containers:
        - name: authentik
          image: goauthentik/server:2023.6.1
          imagePullPolicy: IfNotPresent
          args: ["server"]
          env:
            - name: AUTHENTIK_AVATARS
              value: "gravatar"
            - name: AUTHENTIK_BOOTSTRAP_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: authentik-secrets
                  key: bootstrap-password
                  optional: false
            - name: AUTHENTIK_BOOTSTRAP_TOKEN
              valueFrom:
                secretKeyRef:
                  name: authentik-secrets
                  key: bootstrap-token
                  optional: false
            - name: AUTHENTIK_BOOTSTRAP_EMAIL
              value: "redacted"
            - name: AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME
              value: "false"
            - name: AUTHENTIK_EMAIL__FROM
              value: "redacted"
            - name: AUTHENTIK_EMAIL__HOST
              value: "redacted
            - name: AUTHENTIK_EMAIL__PASSWORD
              valueFrom:
                secretKeyRef:
                  name: authentik-secrets
                  key: email-password
                  optional: false
            - name: AUTHENTIK_EMAIL__PORT
              value: "587"
            - name: AUTHENTIK_EMAIL__TIMEOUT
              value: "30"
            - name: AUTHENTIK_EMAIL__USE_SSL
              value: "false"
            - name: AUTHENTIK_EMAIL__USE_TLS
              value: "true"
            - name: AUTHENTIK_EMAIL__USERNAME
              value: "authentik"
            - name: AUTHENTIK_ERROR_REPORTING__ENABLED
              value: "false"
            - name: AUTHENTIK_ERROR_REPORTING__ENVIRONMENT
              value: "k8s"
            - name: AUTHENTIK_ERROR_REPORTING__SEND_PII
              value: "false"
            - name: AUTHENTIK_GEOIP
              value: "/geoip/GeoLite2-City.mmdb"
            - name: AUTHENTIK_LOG_LEVEL
              value: "info"
            - name: AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE
              value: "goauthentik/%(type)s:%(version)s"
            - name: AUTHENTIK_POSTGRESQL__HOST
              value: "authentik-postgresql"
            - name: AUTHENTIK_POSTGRESQL__NAME
              value: "authentik"
            - name: AUTHENTIK_POSTGRESQL__PASSWORD
              valueFrom:
                secretKeyRef:
                  name: authentik-secrets
                  key: postgresql-user-password
                  optional: false
            - name: AUTHENTIK_POSTGRESQL__PORT
              value: "5432"
            - name: AUTHENTIK_POSTGRESQL__USER
              value: "authentik"
            - name: AUTHENTIK_REDIS__HOST
              value: "authentik-redis-master"
            - name: AUTHENTIK_REDIS__PASSWORD
              valueFrom:
                secretKeyRef:
                  name: authentik-secrets
                  key: redis-password
                  optional: false
            - name: AUTHENTIK_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: authentik-secrets
                  key: secret-key
                  optional: false
          ports:
            - name: http
              containerPort: 9000
              protocol: TCP
            - name: http-metrics
              containerPort: 9300
              protocol: TCP
            - name: https
              containerPort: 9443
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /-/health/live/
              port: http
            initialDelaySeconds: 50
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /-/health/ready/
              port: http
            initialDelaySeconds: 50
            periodSeconds: 10

Your .env content

See above

Reproduction steps

1.Setup an oidc provider
2.Setup Immich to use the oidc provider
3.Create a user with a username that is an email address
4.Login to Immich with the new user.

Additional information

No response

Originally created by @pixil98 on GitHub (Jul 20, 2023). ### The bug When using the new functionality to set a storage label from a claim when using oauth, the claim seems to be taken without sanitation. In my setup the preferred_username is an email address so it has a `.` in it. ![image](https://github.com/immich-app/immich/assets/46978190/59276f1f-4ddc-4646-a36c-9304928121c2) If I try to set the same storage label manually, the `.` is stripped out when it is saved. I assume it's stripped out for a reason, but either way it would be good to be consistent. ### The OS that Immich Server is running on Debian ### Version of Immich Server v1.68.0 ### Version of Immich Mobile App N/A ### Platform with the issue - [X] Server - [X] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML apiVersion: apps/v1 kind: Deployment metadata: name: authentik-server namespace: auth labels: app.kubernetes.io/name: server app.kubernetes.io/instance: authentik spec: replicas: 1 selector: matchLabels: app.kubernetes.io/name: server app.kubernetes.io/instance: authentik template: metadata: labels: app.kubernetes.io/name: server app.kubernetes.io/instance: authentik spec: containers: - name: authentik image: goauthentik/server:2023.6.1 imagePullPolicy: IfNotPresent args: ["server"] env: - name: AUTHENTIK_AVATARS value: "gravatar" - name: AUTHENTIK_BOOTSTRAP_PASSWORD valueFrom: secretKeyRef: name: authentik-secrets key: bootstrap-password optional: false - name: AUTHENTIK_BOOTSTRAP_TOKEN valueFrom: secretKeyRef: name: authentik-secrets key: bootstrap-token optional: false - name: AUTHENTIK_BOOTSTRAP_EMAIL value: "redacted" - name: AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME value: "false" - name: AUTHENTIK_EMAIL__FROM value: "redacted" - name: AUTHENTIK_EMAIL__HOST value: "redacted - name: AUTHENTIK_EMAIL__PASSWORD valueFrom: secretKeyRef: name: authentik-secrets key: email-password optional: false - name: AUTHENTIK_EMAIL__PORT value: "587" - name: AUTHENTIK_EMAIL__TIMEOUT value: "30" - name: AUTHENTIK_EMAIL__USE_SSL value: "false" - name: AUTHENTIK_EMAIL__USE_TLS value: "true" - name: AUTHENTIK_EMAIL__USERNAME value: "authentik" - name: AUTHENTIK_ERROR_REPORTING__ENABLED value: "false" - name: AUTHENTIK_ERROR_REPORTING__ENVIRONMENT value: "k8s" - name: AUTHENTIK_ERROR_REPORTING__SEND_PII value: "false" - name: AUTHENTIK_GEOIP value: "/geoip/GeoLite2-City.mmdb" - name: AUTHENTIK_LOG_LEVEL value: "info" - name: AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE value: "goauthentik/%(type)s:%(version)s" - name: AUTHENTIK_POSTGRESQL__HOST value: "authentik-postgresql" - name: AUTHENTIK_POSTGRESQL__NAME value: "authentik" - name: AUTHENTIK_POSTGRESQL__PASSWORD valueFrom: secretKeyRef: name: authentik-secrets key: postgresql-user-password optional: false - name: AUTHENTIK_POSTGRESQL__PORT value: "5432" - name: AUTHENTIK_POSTGRESQL__USER value: "authentik" - name: AUTHENTIK_REDIS__HOST value: "authentik-redis-master" - name: AUTHENTIK_REDIS__PASSWORD valueFrom: secretKeyRef: name: authentik-secrets key: redis-password optional: false - name: AUTHENTIK_SECRET_KEY valueFrom: secretKeyRef: name: authentik-secrets key: secret-key optional: false ports: - name: http containerPort: 9000 protocol: TCP - name: http-metrics containerPort: 9300 protocol: TCP - name: https containerPort: 9443 protocol: TCP livenessProbe: httpGet: path: /-/health/live/ port: http initialDelaySeconds: 50 periodSeconds: 10 readinessProbe: httpGet: path: /-/health/ready/ port: http initialDelaySeconds: 50 periodSeconds: 10 ``` ### Your .env content ```Shell See above ``` ### Reproduction steps ```bash 1.Setup an oidc provider 2.Setup Immich to use the oidc provider 3.Create a user with a username that is an email address 4.Login to Immich with the new user. ``` ### Additional information _No response_
OVERLORD added the 🗄️servergood first issue labels 2026-02-05 00:33:36 +03:00
OVERLORD commented 2026-02-05 00:33:41 +03:00
Author
Owner
Copy Link

@serfriz commented on GitHub (Nov 5, 2023):

Is there a reason why the dots . need to be stripped out of the storage labels? It would be nice to be able to have labels like firstname.lastname.

@serfriz commented on GitHub (Nov 5, 2023): Is there a reason why the dots `.` need to be stripped out of the storage labels? It would be nice to be able to have labels like `firstname.lastname`.
OVERLORD commented 2026-02-05 00:33:45 +03:00
Author
Owner
Copy Link

@alextran1502 commented on GitHub (Nov 5, 2023):

It is stripped out to prevent path traversal attack I believe

@alextran1502 commented on GitHub (Nov 5, 2023): It is stripped out to prevent path traversal attack I believe
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label good first issue 🗄️server
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#1127
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?