From e64cd84081145912120f8610a0504d472a9148be Mon Sep 17 00:00:00 2001 From: Michael Telatynski <7t3chguy@gmail.com> Date: Tue, 13 May 2025 11:28:56 +0100 Subject: [PATCH 1/3] Fix client_registration URI regex not accepting full query string grammar --- policies/client_registration/client_registration.rego | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/policies/client_registration/client_registration.rego b/policies/client_registration/client_registration.rego index e3299ed36..2a990b7aa 100644 --- a/policies/client_registration/client_registration.rego +++ b/policies/client_registration/client_registration.rego @@ -13,9 +13,9 @@ allow if { parse_uri(url) := obj if { is_string(url) - url_regex := `^(?P[a-z][a-z0-9+.-]*):(?://(?P((?:(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])\.)*(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])|127.0.0.1|0.0.0.0|\[::1\])(?::(?P[0-9]+))?))?(?P/[A-Za-z0-9/.-]*)?(?P\?[A-Za-z0-9/.-=]*)?$` + url_regex := `^(?P[a-z][a-z0-9+.-]*):(?://(?P((?:(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])\.)*(?:[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])|127.0.0.1|0.0.0.0|\[::1\])(?::(?P[0-9]+))?))?(?P/[A-Za-z0-9/.-]*)?(?P\?[-a-zA-Z0-9()@:%_+.~#?&/=]*)?$` [matches] := regex.find_all_string_submatch_n(url_regex, url, 1) - obj := {"scheme": matches[1], "authority": matches[2], "host": matches[3], "port": matches[4], "path": matches[5]} + obj := {"scheme": matches[1], "authority": matches[2], "host": matches[3], "port": matches[4], "path": matches[5], "query": matches[6]} } secure_url(_) if { From 26851334106dcd919cea3d53e2f18938e7c51a61 Mon Sep 17 00:00:00 2001 From: Michael Telatynski <7t3chguy@gmail.com> Date: Wed, 28 May 2025 14:53:19 +0100 Subject: [PATCH 2/3] Add tests --- .../client_registration_test.rego | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/policies/client_registration/client_registration_test.rego b/policies/client_registration/client_registration_test.rego index 568a6b297..3ae376fd4 100644 --- a/policies/client_registration/client_registration_test.rego +++ b/policies/client_registration/client_registration_test.rego @@ -215,6 +215,13 @@ test_web_redirect_uri if { "redirect_uris": ["https://example.com/second/callback", "https://example.com/callback", "https://example.com/callback?query=value"], } + client_registration.allow with input.client_metadata as { + "application_type": "web", + "client_uri": "http://localhost:8080", + "redirect_uris": ["http://localhost:8080/?no_universal_links=true"], + } + with client_registration.allow_insecure_uris as true + # HTTPS redirect_uri with non-standard port client_registration.allow with input.client_metadata as { "application_type": "web", @@ -403,3 +410,13 @@ test_reverse_dns_match if { not client_registration.reverse_dns_match("example.com", "org.example") not client_registration.reverse_dns_match("test.com", "com.example") } + +test_parse_uri if { + client_uri_query := client_registration.parse_uri("https://example.com:8080/users?query=test") + client_uri_query.authority == "example.com:8080" + client_uri_query.host == "example.com" + client_uri_query.path == "/users" + client_uri_query.scheme == "https" + client_uri_query.port == "8080" + client_uri_query.query == "?query=test" +} \ No newline at end of file From 6ecc150def07374cde08f7c4843c881c996c0920 Mon Sep 17 00:00:00 2001 From: Michael Telatynski <7t3chguy@gmail.com> Date: Wed, 28 May 2025 14:57:51 +0100 Subject: [PATCH 3/3] delint --- policies/client_registration/client_registration_test.rego | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policies/client_registration/client_registration_test.rego b/policies/client_registration/client_registration_test.rego index 3ae376fd4..034f5243b 100644 --- a/policies/client_registration/client_registration_test.rego +++ b/policies/client_registration/client_registration_test.rego @@ -419,4 +419,4 @@ test_parse_uri if { client_uri_query.scheme == "https" client_uri_query.port == "8080" client_uri_query.query == "?query=test" -} \ No newline at end of file +}