reta commented on code in PR #3318:
URL: https://github.com/apache/cxf/pull/3318#discussion_r3611622661
##########
rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/DynamicRegistrationService.java:
##########
@@ -366,12 +372,44 @@ protected boolean isPasswordRequired(List<String>
grantTypes, String tokenEndpoi
||
OAuthConstants.TOKEN_ENDPOINT_AUTH_POST.equals(tokenEndpointAuthMethod));
}
+ @SuppressWarnings("PMD.CollapsibleIfStatements")
protected void validateRequestUri(String uri, String appType, List<String>
grantTypes) {
+ if (uri == null || uri.isBlank()) {
+ throw new OAuthServiceException("Empty redirect URI are not
supported");
+ }
+
// Web Clients using the OAuth Implicit Grant Type MUST only register
URLs using the https scheme
// as redirect_uris; they MUST NOT use localhost as the hostname.
Native Clients MUST only register
- // redirect_uris using custom URI schemes or URLs using the http:
scheme with localhost as the hostname.
+ // redirect_uris using custom URI schemes or loopback URLs using the
http scheme; loopback URLs use
+ // localhost or the IP loopback literals 127.0.0.1 or [::1] as the
hostname.
// Authorization Servers MAY place additional constraints on Native
Clients. Authorization Servers MAY
// reject Redirection URI values using the http scheme, other than the
localhost case for Native Clients
+
+ final URI parsedUri = URI.create(uri);
+ if (parsedUri.getHost() == null || parsedUri.getScheme() == null) {
+ throw new OAuthServiceException("Unsupported redirect URI
scheme/host");
+ }
+ final String host = parsedUri.getHost().toLowerCase();
+ final String scheme = parsedUri.getScheme().toLowerCase();
+ if (!URIResolver.getAllowedSchemes().contains(scheme)) {
+ throw new OAuthServiceException("Redirect URI scheme is not
allowed: " + scheme
+ + "Allowed schemes: " + URIResolver.getAllowedSchemes());
+ }
Review Comment:
@coheigea this is probably the only unknown for me, if you could help: what
this custom URL schemes are and how to handle them? thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
