letro/letro-authentication-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fixup! policies: allow subdomains for the various URIs

Browse Source
This commit is contained in:
Quentin Gliech
2023-09-15 19:26:11 +02:00
parent 862924c52c
commit c1cbde5ee1
2 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
policies/client_registration.rego
View File

@@ -172,17 +172,17 @@ reverse_dns_match(host, reverse_dns) {
# Used to verify that all the various URIs are subdomains of the client_uri
is_subdomain(host, subdomain) {
is_string(host)
is_string(subdomain)
is_string(host)
is_string(subdomain)
# Split the host
host_parts := array.reverse(split(host, "."))
# Split the host
host_parts := array.reverse(split(host, "."))
# Split the subdomain
subdomain_parts := array.reverse(split(subdomain, "."))
# Split the subdomain
subdomain_parts := array.reverse(split(subdomain, "."))
# Check that the subdomain strictly is a subdomain of the host
array.slice(subdomain_parts, 0, count(host_parts)) == host_parts
# Check that the subdomain strictly is a subdomain of the host
array.slice(subdomain_parts, 0, count(host_parts)) == host_parts
}
valid_native_redirector(x) {

18
policies/client_registration_test.rego
View File

@@ -435,15 +435,15 @@ test_client_credentials_grant {
}
test_is_subdomain {
is_subdomain("example.com", "example.com")
is_subdomain("example.com", "app.example.com")
not is_subdomain("example.com", "example.org")
not is_subdomain("test.com", "example.com")
is_subdomain("example.com", "example.com")
is_subdomain("example.com", "app.example.com")
not is_subdomain("example.com", "example.org")
not is_subdomain("test.com", "example.com")
}
test_reverse_dns_match {
reverse_dns_match("example.com", "com.example")
reverse_dns_match("example.com", "com.example.app")
not reverse_dns_match("example.com", "org.example")
not reverse_dns_match("test.com", "com.example")
}
reverse_dns_match("example.com", "com.example")
reverse_dns_match("example.com", "com.example.app")
not reverse_dns_match("example.com", "org.example")
not reverse_dns_match("test.com", "com.example")
}