diff options
| author | M Hickford <mirth.hickford@gmail.com> | 2022-09-28 23:19:55 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-09-29 00:19:55 +0200 |
| commit | 6a45a691c19003c15ceee3e14a321a90dfef5183 (patch) | |
| tree | 7f6d4b61600246ddb986734fe556d0f47465734c /models/auth/oauth2_test.go | |
| parent | 0e83ab8df7fb3eec9e8b6e614ad64397e22a09ba (diff) | |
| download | gitea-6a45a691c19003c15ceee3e14a321a90dfef5183.tar.gz gitea-6a45a691c19003c15ceee3e14a321a90dfef5183.zip | |
Ignore port for loopback redirect URIs (#21293)
Following https://datatracker.ietf.org/doc/html/rfc8252#section-7.3
Fixes #21285
Diffstat (limited to 'models/auth/oauth2_test.go')
| -rw-r--r-- | models/auth/oauth2_test.go | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/models/auth/oauth2_test.go b/models/auth/oauth2_test.go index 3b2ba8c8f1..3815cb3b2c 100644 --- a/models/auth/oauth2_test.go +++ b/models/auth/oauth2_test.go @@ -43,6 +43,26 @@ func TestOAuth2Application_ContainsRedirectURI(t *testing.T) { assert.False(t, app.ContainsRedirectURI("d")) } +func TestOAuth2Application_ContainsRedirectURI_WithPort(t *testing.T) { + app := &auth_model.OAuth2Application{ + RedirectURIs: []string{"http://127.0.0.1/", "http://::1/", "http://192.168.0.1/", "http://intranet/", "https://127.0.0.1/"}, + } + + // http loopback uris should ignore port + // https://datatracker.ietf.org/doc/html/rfc8252#section-7.3 + assert.True(t, app.ContainsRedirectURI("http://127.0.0.1:3456/")) + assert.True(t, app.ContainsRedirectURI("http://127.0.0.1/")) + assert.True(t, app.ContainsRedirectURI("http://[::1]:3456/")) + + // not http + assert.False(t, app.ContainsRedirectURI("https://127.0.0.1:3456/")) + // not loopback + assert.False(t, app.ContainsRedirectURI("http://192.168.0.1:9954/")) + assert.False(t, app.ContainsRedirectURI("http://intranet:3456/")) + // unparseable + assert.False(t, app.ContainsRedirectURI(":")) +} + func TestOAuth2Application_ValidateClientSecret(t *testing.T) { assert.NoError(t, unittest.PrepareTestDatabase()) app := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{ID: 1}) |