Adjust Tenable integration by requiring auth and validating host URLs

apps/backend/.env-example

@@ -40,7 +40,12 @@ NGINX_HOST=<Templated out as the 'server_name' for the NGINX configuration (no d
 
 ## External interfaces 
 SPLUNK_HOST_URL=<The full Uniform Resource Locator (URL) without the port for the Splunk host (no default, must be set if connecting to Splunk)>
-TENABLE_HOST_URL=<The full Uniform Resource Locator (URL) without the port for the Tenable.SC host (no default, must be set if connecting to Tenable)>
+TENABLE_HOST_URL=<Full URL for the Tenable.SC host, including port (defaults to :443 if the client doesn't specify one). For multiple allowed hosts, wrap the value in quotes and separate with newlines, e.g.
+```
+TENABLE_HOST_URL='https://a.example.com
+https://b.example.com:8443'
+```
+Client-supplied host_url values not matching an entry in this list are rejected>
 
 # Authentication
 

apps/backend/config/app_config.ts

@@ -27,11 +27,11 @@
   }
 
   set(key: string, value: string | undefined): void {
     this.envConfig[key] = value;
   }
 
   get(key: string): string | undefined {
     return process.env[key] || this.envConfig[key];
   }
 
   getExternalUrl(): string {
@@ -52,13 +52,44 @@
     }
   }
 
-  getTenableHostUrl(): string {
+  // Newline-separated allowlist of Tenable.SC hosts for the login/proxy endpoints
+  // Entries must include a protocol and may include a port; malformed entries throw at startup.
+  getTenableHostUrl(): string[] {
     const tenable_host_url = this.get('TENABLE_HOST_URL');
-    if (tenable_host_url !== undefined) {
-      return tenable_host_url;
-    } else {
-      return '';
+    if (tenable_host_url === undefined) {
+      return [];
     }
+    return tenable_host_url
+      .split('\n')
+      .map((url) => url.trim())
+      .filter((url) => url.length > 0)
+      .map((url) => {
+        let parsed: URL;
+        try {
+          parsed = new URL(url);
+        } catch {
+          throw new Error(
+            `Invalid TENABLE_HOST_URL entry "${url}": must be a complete URL including protocol (e.g. https://example.com)`
+          );
+        }
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+          throw new Error(
+            `Invalid TENABLE_HOST_URL entry "${url}": protocol must be http or https`
+          );
+        }
+        // Only protocol + hostname + port are allowed; ports are permitted since
+        // Tenable.SC may run on a non-default port.
+        const hasExtra =
+          (parsed.pathname !== '' && parsed.pathname !== '/') ||
+          parsed.search !== '' ||
+          parsed.hash !== '';
+        if (hasExtra) {
+          throw new Error(
+            `Invalid TENABLE_HOST_URL entry "${url}": must contain only a protocol, hostname, and optional port (no path, query, or fragment)`
+          );
+        }
+        return parsed.origin;
+      });
   }
 
   getDatabaseName(): string {
@@ -91,8 +122,8 @@
         sslKey = this.get('DATABASE_SSL_KEY');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_KEY')!).isFile()) {
           sslKey = fs.readFileSync(this.get('DATABASE_SSL_KEY')!);
         } else {
           throw new Error('SSL Key file does not exist');
         }
@@ -104,8 +135,8 @@
         sslCert = this.get('DATABASE_SSL_CERT');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_CERT')!).isFile()) {
           sslCert = fs.readFileSync(this.get('DATABASE_SSL_CERT')!);
         } else {
           throw new Error('SSL Cert file does not exist');
         }
@@ -117,8 +148,8 @@
         sslCA = this.get('DATABASE_SSL_CA');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_CA')!).isFile()) {
           sslCA = fs.readFileSync(this.get('DATABASE_SSL_CA')!);
         } else {
           throw new Error('SSL CA file does not exist');
         }
@@ -162,7 +193,7 @@
       return false;
     } else {
       const pattern =
         /^(?:([^:\/?#\s]+):\/{2})?(?:([^@\/?#\s]+)@)?([^\/?#\s]+)?(?:\/([^?#\s]*))?(?:[?]([^#\s]+))?\S*$/;
       const matches = url.match(pattern);
 
       if (matches === null) {

apps/backend/src/config/config.service.ts

@@ -74,7 +74,7 @@ export class ConfigService {
     return this.appConfig.getSplunkHostUrl();
   }
 
-  getTenableHostUrl(): string {
+  getTenableHostUrl(): string[] {
     return this.appConfig.getTenableHostUrl();
   }
 

apps/backend/src/config/dto/startup-settings.dto.ts

@@ -12,7 +12,7 @@ export class StartupSettingsDto implements IStartupSettings {
   readonly ldap: boolean;
   readonly registrationEnabled: boolean;
   readonly localLoginEnabled: boolean;
-  readonly tenableHostUrl: string;
+  readonly tenableHostUrl: string[];
   readonly forceTenableFrontend: boolean;
   readonly splunkHostUrl: string;
 

apps/backend/src/main.ts

@@ -58,7 +58,7 @@ async function bootstrap() {
           "'self'",
           'https://api.github.com',
           'https://sts.amazonaws.com',
-          configService.getTenableHostUrl(),
+          ...configService.getTenableHostUrl(),
           configService.getSplunkHostUrl()
         ].filter((source) => source)
       }