Skip to content

restrict url schemes allowed in oauth metadata #877

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Aug 19, 2025
+157 −18
Merged

restrict url schemes allowed in oauth metadata #877

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
64e31a0
restrict url schemes allowed in metadata
pcarleton Aug 14, 2025
a9ce670
add test for rejections
pcarleton Aug 15, 2025
45bbd9b
also reject data, vbscript
pcarleton Aug 15, 2025
ef3d93f
fix: update test error messages for expanded URL scheme validation
pcarleton Aug 15, 2025
0a67d32
check protocol from parsed url
pcarleton Aug 19, 2025
0d679c6
fix with url parsing being fatal
pcarleton Aug 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 31 additions & 18 deletions src/shared/auth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,25 @@
import { z } from "zod";

/**
* Reusable URL validation that disallows javascript: scheme
*/
export const SafeUrlSchema = z.string().url()
.refine(
(url) => URL.canParse(url),
{message: "URL must be parseable"}
).refine(
(url) => !url.toLowerCase().startsWith('javascript:'),
{ message: "URL cannot use javascript: scheme" }
);


/**
* RFC 9728 OAuth Protected Resource Metadata
*/
export const OAuthProtectedResourceMetadataSchema = z
.object({
resource: z.string().url(),
authorization_servers: z.array(z.string().url()).optional(),
authorization_servers: z.array(SafeUrlSchema).optional(),
jwks_uri: z.string().url().optional(),
scopes_supported: z.array(z.string()).optional(),
bearer_methods_supported: z.array(z.string()).optional(),
Expand All @@ -28,9 +41,9 @@
export const OAuthMetadataSchema = z
.object({
issuer: z.string(),
authorization_endpoint: z.string(),
token_endpoint: z.string(),
registration_endpoint: z.string().optional(),
authorization_endpoint: SafeUrlSchema,
token_endpoint: SafeUrlSchema,
registration_endpoint: SafeUrlSchema.optional(),
scopes_supported: z.array(z.string()).optional(),
response_types_supported: z.array(z.string()),
response_modes_supported: z.array(z.string()).optional(),
Expand All @@ -39,8 +52,8 @@
token_endpoint_auth_signing_alg_values_supported: z
.array(z.string())
.optional(),
service_documentation: z.string().optional(),
revocation_endpoint: z.string().optional(),
service_documentation: SafeUrlSchema.optional(),
revocation_endpoint: SafeUrlSchema.optional(),
revocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),
revocation_endpoint_auth_signing_alg_values_supported: z
.array(z.string())
Expand All @@ -63,11 +76,11 @@
export const OpenIdProviderMetadataSchema = z
.object({
issuer: z.string(),
authorization_endpoint: z.string(),
token_endpoint: z.string(),
userinfo_endpoint: z.string().optional(),
jwks_uri: z.string(),
registration_endpoint: z.string().optional(),
authorization_endpoint: SafeUrlSchema,
token_endpoint: SafeUrlSchema,
userinfo_endpoint: SafeUrlSchema.optional(),
jwks_uri: SafeUrlSchema,
registration_endpoint: SafeUrlSchema.optional(),
scopes_supported: z.array(z.string()).optional(),
response_types_supported: z.array(z.string()),
response_modes_supported: z.array(z.string()).optional(),
Expand Down Expand Up @@ -101,8 +114,8 @@
request_parameter_supported: z.boolean().optional(),
request_uri_parameter_supported: z.boolean().optional(),
require_request_uri_registration: z.boolean().optional(),
op_policy_uri: z.string().optional(),
op_tos_uri: z.string().optional(),
op_policy_uri: SafeUrlSchema.optional(),
op_tos_uri: SafeUrlSchema.optional(),
})
.passthrough();

Expand Down Expand Up @@ -146,18 +159,18 @@
* RFC 7591 OAuth 2.0 Dynamic Client Registration metadata
*/
export const OAuthClientMetadataSchema = z.object({
redirect_uris: z.array(z.string()).refine((uris) => uris.every((uri) => URL.canParse(uri)), { message: "redirect_uris must contain valid URLs" }),
redirect_uris: z.array(SafeUrlSchema),
token_endpoint_auth_method: z.string().optional(),
grant_types: z.array(z.string()).optional(),
response_types: z.array(z.string()).optional(),
client_name: z.string().optional(),
client_uri: z.string().optional(),
logo_uri: z.string().optional(),
client_uri: SafeUrlSchema.optional(),
logo_uri: SafeUrlSchema.optional(),
scope: z.string().optional(),
contacts: z.array(z.string()).optional(),
tos_uri: z.string().optional(),
tos_uri: SafeUrlSchema.optional(),
policy_uri: z.string().optional(),
jwks_uri: z.string().optional(),
jwks_uri: SafeUrlSchema.optional(),
jwks: z.any().optional(),
software_id: z.string().optional(),
software_version: z.string().optional(),
Expand Down