@flink-app/oidc-plugin 2.0.0-alpha.116 → 2.0.0-alpha.118

package/src/utils/redirect-uri-utils.ts

@@ -0,0 +1,116 @@
+/**
+ * Redirect URI allow-list utilities
+ *
+ * The `?redirectUri=` query parameter on `/oidc/:provider/initiate` decides where the
+ * host's JWT is delivered once the OIDC flow completes. It is attacker-controllable —
+ * anyone can craft an initiate link — so deployments should restrict it to the URLs
+ * their own clients use via the `allowedRedirectUris` plugin option.
+ */
+
+/**
+ * Allow-list for the `redirectUri` query parameter.
+ *
+ * Either a list of entries or a predicate:
+ * - An entry that is a bare origin (`https://app.example.com`, `myapp://cb`) matches any
+ *   path/query/fragment below that origin.
+ * - An entry with a path (`https://app.example.com/login`) matches that exact URI only.
+ * - A predicate receives the requested redirectUri and the provider name.
+ */
+export type AllowedRedirectUris = string[] | ((redirectUri: string, provider: string) => boolean);
+
+/**
+ * Whether a redirect target is a relative path on the plugin's own origin.
+ *
+ * `/dashboard` and `/login?error=x` are relative. `//evil.example` (protocol-relative)
+ * and `/\evil.example` are NOT — browsers resolve both of those to another origin.
+ */
+export function isRelativeRedirect(redirectUri: string): boolean {
+    return /^\/(?![/\\])/.test(redirectUri);
+}
+
+function parseUrl(value: string): URL | undefined {
+    try {
+        return new URL(value);
+    } catch {
+        return undefined;
+    }
+}
+
+/**
+ * Origin of a URL, including custom schemes.
+ * `URL.origin` is the string "null" for non-special schemes (e.g. `myapp://cb`),
+ * so fall back to scheme + host for those.
+ */
+function originOf(url: URL): string {
+    return url.origin && url.origin !== "null" ? url.origin : `${url.protocol}//${url.host}`;
+}
+
+/**
+ * Whether an allow-list entry names a bare origin (no path, query or fragment)
+ * and therefore matches every URI below that origin.
+ */
+function isOriginOnlyEntry(url: URL): boolean {
+    return (url.pathname === "" || url.pathname === "/") && !url.search && !url.hash;
+}
+
+/**
+ * Match a redirect URI against a single allow-list entry.
+ * Exact string match always wins; origin-only entries additionally match by origin.
+ */
+function matchesEntry(redirectUri: string, entry: string): boolean {
+    if (redirectUri === entry) {
+        return true;
+    }
+
+    const entryUrl = parseUrl(entry);
+    if (!entryUrl || !isOriginOnlyEntry(entryUrl)) {
+        return false;
+    }
+
+    const targetUrl = parseUrl(redirectUri);
+    if (!targetUrl) {
+        return false;
+    }
+
+    return originOf(targetUrl) === originOf(entryUrl);
+}
+
+/**
+ * Check whether a redirect URI is allowed.
+ *
+ * @param redirectUri - The redirect target to check
+ * @param provider - Provider name (passed to the predicate form)
+ * @param allowedRedirectUris - The `allowedRedirectUris` plugin option. Undefined means
+ *   no allow-list is configured and every URI is accepted (legacy behaviour).
+ * @param alwaysAllowed - Entries that bypass the allow-list, e.g. the provider's own
+ *   `callbackUrl` and the redirectUri already validated at initiate time.
+ * @returns true if the redirect may be performed
+ */
+export function isRedirectUriAllowed(
+    redirectUri: string,
+    provider: string,
+    allowedRedirectUris?: AllowedRedirectUris,
+    alwaysAllowed: (string | undefined)[] = []
+): boolean {
+    // No allow-list configured: unchanged (permissive) behaviour
+    if (allowedRedirectUris === undefined) {
+        return true;
+    }
+
+    // Relative paths can only land on the plugin's own origin
+    if (isRelativeRedirect(redirectUri)) {
+        return true;
+    }
+
+    for (const entry of alwaysAllowed) {
+        if (entry && matchesEntry(redirectUri, entry)) {
+            return true;
+        }
+    }
+
+    if (typeof allowedRedirectUris === "function") {
+        return allowedRedirectUris(redirectUri, provider);
+    }
+
+    return allowedRedirectUris.some((entry) => matchesEntry(redirectUri, entry));
+}