backport oauth2_proxy: 6.0.0 -> 7.0.1 [security]

[yorickvP]

Motivation for this change

Security backport, fixes #113489

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[SuperSandro2000]

Is this major update backwards compatible?

[yorickvP]

Sadly, no: https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0
Our alternative is keeping this bug and/or marking oauth2-proxy as insecure.

[knl]

I think we'll either have to mark it as insecure or backport that particular security fix. The issue is that (to the best to my recollection) backward incompatible changes are disallowed on the release branches.

Reading the changelog suggests that 6.1.1 should be good to use: https://github.com/oauth2-proxy/oauth2-proxy/blob/master/CHANGELOG.md#changes-since-v611

[knl]

Also, 7.0.1 should use Go 1.16: oauth2-proxy/oauth2-proxy#1054 (nixpkgs code forces Go 1.15)

[yorickvP]

6.1.1 would be vulnerable to CVE-2021-21291. Maybe it's possible to backport oauth2-proxy/oauth2-proxy@780ae4f ?

[SuperSandro2000]

Also, 7.0.1 should use Go 1.16: oauth2-proxy/oauth2-proxy#1054 (nixpkgs code forces Go 1.15)

We can change that version but 1.16 is not yet available in 20.09.

[risicle]

Maybe it's possible to backport oauth2-proxy/oauth2-proxy@780ae4f ?

The function in question hasn't been touched in 13 months previous to the patch, other than being relocated in the same file. The interface around it looks to be the same judging by its tests. OAuthProxy.whitelistDomains is still an array of strings in the same format. And sure enough the patch applies without a hitch and the added test passes. #119899

[risicle]

We can change that version but 1.16 is not yet available in 20.09.

You're going to have to stop giving me opportunities to plug #116665

[yorickvP]

Closing in favor of #119899