Issue #1883: accept non-public TLDs in redirect URLs.#1894
Open
mbert wants to merge 1 commit into
Open
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
WalkthroughReplaces Apache Commons UrlValidator with RedirectURLValidator using a strict authority-part regex, integrates it into IdentityProviderUtil, and adds comprehensive JUnit tests for many valid and invalid redirect-URL cases. ChangesRedirect URL Validation Enhancement
Sequence DiagramsequenceDiagram
participant IdentityProviderUtil
participant RedirectURLValidator
participant ApacheUrlValidator
participant RegexValidator
IdentityProviderUtil->>RedirectURLValidator: isValid(uri)
RedirectURLValidator->>ApacheUrlValidator: isValid(uri, null)
ApacheUrlValidator->>RegexValidator: validate authority part (host[:port])
RegexValidator-->>ApacheUrlValidator: regex match result
ApacheUrlValidator-->>RedirectURLValidator: validation result
RedirectURLValidator-->>IdentityProviderUtil: true/false
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly Related Issues
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@esignet-core/src/main/java/io/mosip/esignet/core/validator/RedirectURLValidator.java`:
- Around line 16-30: The custom authority regex (AUTHORITY_PART_RX) in
RedirectURLValidator (and its components IPV6_REGEX, DOMAIN_REGEX) is too
permissive and short-circuits UrlValidator by using new
RegexValidator(AUTHORITY_PART_RX), allowing invalid hosts; change the
implementation to stop passing a full-authority RegexValidator to UrlValidator —
instead parse the authority into host and optional port in RedirectURLValidator,
validate the port separately, and pass only the scheme/URL to UrlValidator (or
call UrlValidator.isValidHost()/DomainValidator/IP validators directly) so
Commons Validator’s built-in DomainValidator and IP validation are used for host
checks; update urlValidator usage to rely on UrlValidator/DomainValidator
methods and add regression tests for invalid hosts like “[::::]” and labels
starting/ending with “-”.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: a1dff8c5-2474-4fd2-91de-d51bb2cb159d
📒 Files selected for processing (3)
esignet-core/src/main/java/io/mosip/esignet/core/util/IdentityProviderUtil.javaesignet-core/src/main/java/io/mosip/esignet/core/validator/RedirectURLValidator.javaesignet-core/src/test/java/io/mosip/esignet/core/validator/RedirectURLValidatorTest.java
* Previously a simple instance of the Apache UrlValidator was used. * This lead to TLDs being validated, so that custom TLDs, e.g. from internal environments, would be marked invalid. * The solution is to validate the authority part (host + if present port) using a regular expression. * Use this validator also in IdentityProviderUtil for consistency.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This fixes issue #1883.
Redirect URLs are validated using Apache UrlValidator which will also validate a URL's TLD against a whitelist. This leads to a new restriction: eSignet cannot redirect to URLs in sandbox environments where the TLD is not "official".
In a sandbox environment, an organisation-wide root CA can be used to sign sandbox hosts' TLS certificates, hence they cannot just be renamed to something the UrlValidator acceps.
As a solution I propose to skip the validation of TLDs against the whitelist. Unfortunately this is a bit awkward when using Apache's UrlValidator, one has to implement the hostname + if present port validation oneself using a RegexValidator.
This PR provides such an implementation.
Summary by CodeRabbit
Improvements
Tests