letro/letro-authentication-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Allow more characters in redirect URI paths (#4975)

Browse Source
This commit is contained in:
Quentin Gliech
2025-09-12 14:51:36 +02:00
committed by GitHub
parent 73c6b24881 b2d7e2d835
commit 2ed3ee08f9
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
policies/client_registration/client_registration.rego
View File

@@ -18,7 +18,7 @@ allow if {
parse_uri(url) := obj if { parse_uri(url) := obj if {
is_string(url) is_string(url)
url_regex := `^(?P<scheme>[a-z][a-z0-9+.-]*):(?://(?P<host>((?:(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])\.)*(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])|127.0.0.1|0.0.0.0|\[::1\])(?::(?P<port>[0-9]+))?))?(?P<path>/[A-Za-z0-9/.-]*)?(?P<query>\?[-a-zA-Z0-9()@:%_+.~#?&/=]*)?$` url_regex := `^(?P<scheme>[a-z][a-z0-9+.-]*):(?://(?P<host>((?:(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])\.)*(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])|127.0.0.1|0.0.0.0|\[::1\])(?::(?P<port>[0-9]+))?))?(?P<path>/[A-Za-z0-9/._~-]*)?(?P<query>\?[-a-zA-Z0-9()@:%_+.~#?&/=]*)?$`
[matches] := regex.find_all_string_submatch_n(url_regex, url, 1) [matches] := regex.find_all_string_submatch_n(url_regex, url, 1)
obj := {"scheme": matches[1], "authority": matches[2], "host": matches[3], "port": matches[4], "path": matches[5], "query": matches[6]} obj := {"scheme": matches[1], "authority": matches[2], "host": matches[3], "port": matches[4], "path": matches[5], "query": matches[6]}
} }

2
policies/client_registration/client_registration_test.rego
View File

@@ -217,7 +217,7 @@ test_web_redirect_uri if {
client_registration.allow with input.client_metadata as { client_registration.allow with input.client_metadata as {
"application_type": "web", "application_type": "web",
"client_uri": "https://example.com/", "client_uri": "https://example.com/",
"redirect_uris": ["https://example.com/second/callback", "https://example.com/callback", "https://example.com/callback?query=value"], "redirect_uris": ["https://example.com/second/callback", "https://example.com/callback", "https://example.com/callback?query=value", "https://example.com/callback~path_with_extra_chars"],
} }
client_registration.allow with input.client_metadata as { client_registration.allow with input.client_metadata as {