Add unchecked GitLab claims (pypi#15466)

ActiveState · Feb 23, 2024 · 8155a65 · 8155a65
1 parent 137f1fb
commit 8155a65
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/tests/unit/oidc/models/test_gitlab.py b/tests/unit/oidc/models/test_gitlab.py
@@ -58,6 +58,7 @@ def test_gitlab_publisher_all_known_claims(self):
             "exp",
             "aud",
             # unchecked claims
+            "project_id",
             "namespace_id",
             "namespace_path",
             "user_id",
@@ -78,6 +79,7 @@ def test_gitlab_publisher_all_known_claims(self):
             "ci_config_sha",
             "project_visibility",
             "jti",
+            "user_access_level",
         }
 
     def test_gitlab_publisher_computed_properties(self):

diff --git a/warehouse/oidc/models/gitlab.py b/warehouse/oidc/models/gitlab.py
@@ -119,6 +119,9 @@ class GitLabPublisherMixin:
     }
 
     __unchecked_claims__ = {
+        # We are not currently verifying project_id or namespace_id to protect against
+        # resurrection attacks: https://github.com/pypi/warehouse/issues/13575
+        "project_id",
         "namespace_id",
         "namespace_path",
         "user_id",
@@ -139,6 +142,7 @@ class GitLabPublisherMixin:
         "ci_config_sha",
         "project_visibility",
         "jti",
+        "user_access_level",
     }
 
     @staticmethod