From f0dce41fbc5649b3a8fe65de36ca20efa521b880 Mon Sep 17 00:00:00 2001 From: Elias Schneider Date: Thu, 17 Apr 2025 20:52:58 +0200 Subject: [PATCH] fix: callback URL doesn't get rejected if it starts with a different string --- backend/internal/service/oidc_service.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/internal/service/oidc_service.go b/backend/internal/service/oidc_service.go index d6bb05b2..db1832b7 100644 --- a/backend/internal/service/oidc_service.go +++ b/backend/internal/service/oidc_service.go @@ -955,7 +955,7 @@ func (s *OidcService) getCallbackURL(urls []string, inputCallbackURL string) (ca } for _, callbackPattern := range urls { - regexPattern := strings.ReplaceAll(regexp.QuoteMeta(callbackPattern), `\*`, ".*") + "$" + regexPattern := "^" + strings.ReplaceAll(regexp.QuoteMeta(callbackPattern), `\*`, ".*") + "$" matched, err := regexp.MatchString(regexPattern, inputCallbackURL) if err != nil { return "", err