letro/letro-authentication-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Fix MSC2966 compliance around redirect_uri validity

Browse Source 
Fixes https://github.com/element-hq/matrix-authentication-service/issues/4528
This commit is contained in:
Michael Telatynski
2025-05-07 18:49:52 +01:00
parent 1566890989
commit b0bbc3bae1
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
policies/client_registration/client_registration.rego
View File

@@ -13,7 +13,7 @@ allow if {
parse_uri(url) := obj if {
is_string(url)
url_regex := `^(?P<scheme>[a-z][a-z0-9+.-]*):(?://(?P<host>((?:(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])\.)*(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])|127.0.0.1|0.0.0.0|\[::1\])(?::(?P<port>[0-9]+))?))?(?P<path>/[A-Za-z0-9/.-]*)$`
url_regex := `^(?P<scheme>[a-z][a-z0-9+.-]*):(?://(?P<host>((?:(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])\.)*(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])|127.0.0.1|0.0.0.0|\[::1\])(?::(?P<port>[0-9]+))?))?(?P<path>/[A-Za-z0-9/.-]*)?(?P<query>\?[A-Za-z0-9/.-=]*)?$`
[matches] := regex.find_all_string_submatch_n(url_regex, url, 1)
obj := {"scheme": matches[1], "authority": matches[2], "host": matches[3], "port": matches[4], "path": matches[5]}
}

12
policies/client_registration/client_registration_test.rego
View File

@@ -212,7 +212,7 @@ test_web_redirect_uri if {
client_registration.allow with input.client_metadata as {
"application_type": "web",
"client_uri": "https://example.com/",
"redirect_uris": ["https://example.com/second/callback", "https://example.com/callback"],
"redirect_uris": ["https://example.com/second/callback", "https://example.com/callback", "https://example.com/callback?query=value"],
}
}
@@ -289,6 +289,14 @@ test_web_redirect_uri_localhost_not_allowed if {
}
}
test_web_redirect_uri_with_query if {
client_registration.allow with input.client_metadata as {
"application_type": "web",
"client_uri": "https://example.com/",
"redirect_uris": ["https://example.com/callback?query=value", "https://example.com?query=value"],
}
}
test_native_redirect_uri_allowed if {
# This has all the redirect URIs types we're supporting for native apps
client_registration.allow with input.client_metadata as {
@@ -387,4 +395,4 @@ test_reverse_dns_match if {
client_registration.reverse_dns_match("example.com", "com.example.app")
not client_registration.reverse_dns_match("example.com", "org.example")
not client_registration.reverse_dns_match("test.com", "com.example")
}
}