[bug] [explore-assistant-cloud-function] has_valid_signature Function Not Called in Cloud Functions Deployment

[mida-hub]

Overview

Hello,
I have encountered a security issue with the current implementation while deploying on Google Cloud Functions. It appears that the has_valid_signature function, intended to validate the incoming request signature, is not being called during execution in a Cloud Functions environment. As a result, anyone with knowledge of the endpoint URL can execute the function without providing a valid signature.

Details

• Problem: Although the has_valid_signature function correctly validates requests when the code is run locally, it is bypassed in a Cloud Functions deployment.

• Impact: This allows execution of the endpoint without the expected signature, thus bypassing the intended security.

• Reference PR: PR #31.

• Code References

  • Local Execution:

    looker-explore-assistant/explore-assistant-cloud-function/main.py

    Lines 124 to 130 in 9f8f60b

    	if contents is None:
    	return "Missing 'contents' parameter", 400
    	if not has_valid_signature(request):
    	return "Invalid signature", 403
    	response_text = generate_looker_query(contents, parameters)

  • Cloud Functions Execution:

    looker-explore-assistant/explore-assistant-cloud-function/main.py

    Lines 146 to 149 in 9f8f60b

    	if contents is None:
    	return "Missing 'contents' parameter", 400
    	response_text = generate_looker_query(contents, parameters)