fixup! fix: map oidc user to iss/sub

Author: jmattheis

api/oidc.go

@@ -8,6 +8,8 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
+	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -399,6 +401,12 @@ func (a *OIDCAPI) resolveUser(issuer string, info *oidc.UserInfo) (*model.User,
 	if issuer == "" {
 		return nil, http.StatusInternalServerError, errors.New("issuer claim was empty")
 	}
+	if _, err := url.Parse(issuer); err != nil {
+		return nil, http.StatusInternalServerError, fmt.Errorf("issuer url %q is not a valid url: %w", issuer, err)
+	}
+	if strings.Contains(issuer, "#") {
+		return nil, http.StatusInternalServerError, fmt.Errorf("issuer url %q may not contain a fragment", issuer)
+	}
 	subject := info.GetSubject()
 	if subject == "" {
 		return nil, http.StatusInternalServerError, errors.New("subject claim was empty")

api/oidc_test.go

@@ -100,6 +100,26 @@ func (s *OIDCSuite) Test_ResolveUser_LinkByUsername_BindsExistingUser() {
 	assert.Equal(s.T(), uint(1), bound.ID)
 }
 
+func (s *OIDCSuite) Test_ResolveUser_InvalidIssuer() {
+	s.db.NewUserWithName(1, "alice")
+
+	info := &oidc.UserInfo{Subject: "sub-1", Claims: map[string]any{"preferred_username": "alice"}}
+	_, status, err := s.a.resolveUser("://example.org", info)
+
+	assert.EqualError(s.T(), err, `issuer url "://example.org" is not a valid url: parse "://example.org": missing protocol scheme`)
+	assert.Equal(s.T(), 500, status)
+}
+
+func (s *OIDCSuite) Test_ResolveUser_InvalidIssuer_containsFragment() {
+	s.db.NewUserWithName(1, "alice")
+
+	info := &oidc.UserInfo{Subject: "sub-1", Claims: map[string]any{"preferred_username": "alice"}}
+	_, status, err := s.a.resolveUser(testIssuer+"#", info)
+
+	assert.EqualError(s.T(), err, `issuer url "https://idp.example.com#" may not contain a fragment`)
+	assert.Equal(s.T(), 500, status)
+}
+
 func (s *OIDCSuite) Test_ResolveUser_LinkDisabled_RejectsExistingUsername() {
 	s.db.NewUserWithName(1, "alice")