mirror of
https://github.com/keycloak/keycloak.git
synced 2026-10-23 19:29:23 +03:00
b1bdd565b9
* Compare redirect URI hostnames case-insensitively Fixes #52119 Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Harden case-insensitive redirect URI matching against review findings Compare raw authorities when parsed hosts are null, handle opaque URIs and unparseable wildcard prefixes safely, and preserve user-info and port-wildcard semantics during redirect validation. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Address remaining review findings for case-insensitive URI matching. Keep opaque fragments and registry user-info case-sensitive, tighten port-wildcard detection, and align iframe/web-origin checks with the same rules. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Update OAuthRedirectUriTest for case-insensitive host/scheme matching. Hostname and scheme case differences are now accepted; keep path comparisons case-sensitive. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Address review feedback for case-insensitive URI matching. Document the scheme/host case change, compare opaque SSP and require explicit ports for port wildcards, and keep user-info out of origin equality. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Fix IPv6 port detection and authority-less wildcard matching. Address Copilot review findings: treat only a colon after ']' as an IPv6 port, compare raw port suffixes so nonnumeric/empty ports are distinct, skip the exact-match fallback for port wildcards, and compare schemes only for authority-less wildcard prefixes. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Distinguish port wildcards from empty-port path wildcards Detect port wildcards from the original :* authority before stripping, so patterns like https://example.com:/* compare ports normally. Clarify the upgrade note that user-info/path rules apply to redirect URIs only. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Ignore example.com URLs in documentation link checks The upgrade note uses example.com redirect URI samples that must not be fetched by ExternalLinksTest. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Normalize redirect/origin hostnames with IDNA before compare Unicode, percent-encoded, and punycode forms of the same hostname now match; registry-names such as underscores still fall back safely. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Compare hosts case-insensitively without IDNA Split raw authorities before host extraction so percent-encoded delimiters cannot spoof user-info, and drop IDNA to avoid transitional mapping mismatches with browsers. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Use ASCII-only case folding for hostname compare String.equalsIgnoreCase also folds Unicode letters, so ı.com incorrectly matched i.com for redirects and CORS origins. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Require trailing :* for port-wildcard redirects An authority containing :* with a later path wildcard must not activate the port-wildcard branch. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Ignore Prometheus metric braces in docs variable check GuideTest.checkVariables falsely flagged HTTP metric label examples in the upgrading guide after quotes were HTML-escaped. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> * Allow wildcards for registry-name redirect hosts Java leaves getHost() null for underscores in registered names, which made areWildcardsAllowed reject valid path wildcards. Recognize those authorities when there is no user-info and any port is valid, preserving the CVE-2026-7504 protections. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com> --------- Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>