Mirror/gitea-mirror
1
0
Fork 0
mirror of https://github.com/RayLabsHQ/gitea-mirror.git synced 2025-12-08 20:46:44 +03:00
Code Issues Packages Projects Releases Wiki Activity

Potential fix for code scanning alert no. 28: Incomplete URL substring sanitization

Browse Source 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This commit is contained in:
ARUNAVO RAY
2025-07-28 15:34:20 +05:30
committed by GitHub
parent 5797b9bba1
commit 3f704ebb23
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/components/config/SSOSettings.tsx
View File

@@ -15,6 +15,14 @@ import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
import { Textarea } from '@/components/ui/textarea'; import { Textarea } from '@/components/ui/textarea';
import { MultiSelect } from '@/components/ui/multi-select'; import { MultiSelect } from '@/components/ui/multi-select';
function isTrustedIssuer(issuer: string, allowedHosts: string[]): boolean {
try {
const url = new URL(issuer);
return allowedHosts.some(host => url.hostname === host || url.hostname.endsWith(`.${host}`));
} catch {
return false; // Return false if the URL is invalid
}
}
interface SSOProvider { interface SSOProvider {
id: string; id: string;
issuer: string; issuer: string;
@@ -509,7 +517,7 @@ export function SSOSettings() {
<AlertDescription> <AlertDescription>
<div className="space-y-2"> <div className="space-y-2">
<p>Redirect URL: {window.location.origin}/api/auth/sso/callback/{providerForm.providerId || '{provider-id}'}</p> <p>Redirect URL: {window.location.origin}/api/auth/sso/callback/{providerForm.providerId || '{provider-id}'}</p>
{providerForm.issuer.includes('google.com') && ( {isTrustedIssuer(providerForm.issuer, ['google.com']) && (
<p className="text-xs text-muted-foreground"> <p className="text-xs text-muted-foreground">
Note: Google doesn't support the "offline_access" scope. Make sure to exclude it from the selected scopes. Note: Google doesn't support the "offline_access" scope. Make sure to exclude it from the selected scopes.
</p> </p>