security: removed snyk issues involving OIDC (#167)

removed writing empty req.body to httpWriter in OIDC authentication.
modified ras.GenerateKey to use 2048 bit encryption in
cicd-integration/generate_pki.go

.changes/unreleased/security-20240807-120631.yaml

@@ -0,0 +1,5 @@
+kind: security
+body: |-
+  removed writing empty req.body to httpWriter in OIDC authentication.
+  modified ras.GenerateKey to use 2048 bit encryption in cicd-integration/generate_pki.go
+time: 2024-08-07T12:06:31.546382-07:00

.gitignore

@@ -126,3 +126,6 @@ snapcraft-login
 
 # mac
 .DS_Store
+
+# snyk
+.dccache

auth/method_oidc.go

@@ -103,9 +103,8 @@ func (a *authenticator) buildOIDCParams(at AuthType, provider string, callback s
 // handleOidcAuth handles OIDC and Thycotic One auths.
 func handleOidcAuth(at AuthType, doneCh chan<- authResponse) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
-		b, err := io.ReadAll(req.Body)
+		_, err := io.ReadAll(req.Body)
 		if err != nil {
-			w.Write([]byte(err.Error()))
 			doneCh <- authResponse{err: fmt.Errorf("reading body: %w", err)}
 		}
 
@@ -116,14 +115,12 @@ func handleOidcAuth(at AuthType, doneCh chan<- authResponse) http.HandlerFunc {
 			doneCh <- authResponse{
 				err: errors.New("missing values in callback, authorization code is empty"),
 			}
-			w.Write(b)
 			return
 		}
 		if state == "" {
 			doneCh <- authResponse{
 				err: errors.New("missing values in callback, authorization state is empty"),
 			}
-			w.Write(b)
 			return
 		}
 

cicd-integration/generate_pki.go

@@ -12,10 +12,13 @@ import (
 	"time"
 )
 
-const leafCommonName = "example.com"
+const (
+	leafCommonName = "example.com"
+	rsaEncrypt     = 2048
+)
 
 func generateRootWithPrivateKey() ([]byte, []byte, error) {
-	privateKey, publicKey := generateRSAKeyPair(2048)
+	privateKey, publicKey := generateRSAKeyPair(rsaEncrypt)
 	ca := &x509.Certificate{
 		DNSNames:     []string{"thycotic.com"},
 		SerialNumber: big.NewInt(int64(mrand.Int31n(big.MaxExp))),
@@ -52,7 +55,7 @@ func generateRootWithPrivateKey() ([]byte, []byte, error) {
 }
 
 func generateCSR() ([]byte, error) {
-	keyBytes, _ := rsa.GenerateKey(rand.Reader, 1024)
+	keyBytes, _ := rsa.GenerateKey(rand.Reader, rsaEncrypt)
 
 	subj := pkix.Name{
 		CommonName:         leafCommonName,