Skip to content

Commit 5d85c61

Browse files
JonathanHuotJonathanHuot
committed
Fix IPV6 regex used to check redirect_uri
1 parent e514826 commit 5d85c61

2 files changed

Lines changed: 48 additions & 5 deletions

File tree

‎oauthlib/uri_validate.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
)
6767

6868
# IPv6address
69-
IPv6address = r"([A-Fa-f0-9:]+:+)+[A-Fa-f0-9]+"
69+
IPv6address = r"([A-Fa-f0-9:]+[:$])[A-Fa-f0-9]{1,4}"
7070

7171
# IPvFuture = "v" 1*HEXDIG "." 1*( unreserved / sub-delims / ":" )
7272
IPvFuture = r"v %(HEXDIG)s+ \. (?: %(unreserved)s | %(sub_delims)s | : )+" % locals()

‎tests/test_uri_validate.py‎

Lines changed: 47 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
import oauthlib
1+
import unittest
22
from oauthlib.uri_validate import is_absolute_uri
33

44
from tests.unittest import TestCase
@@ -7,7 +7,6 @@
77
class UriValidateTest(TestCase):
88

99
def test_is_absolute_uri(self):
10-
1110
self.assertIsNotNone(is_absolute_uri('schema://example.com/path'))
1211
self.assertIsNotNone(is_absolute_uri('https://example.com/path'))
1312
self.assertIsNotNone(is_absolute_uri('https://example.com'))
@@ -17,16 +16,60 @@ def test_is_absolute_uri(self):
1716
self.assertIsNotNone(is_absolute_uri('http://example.com'))
1817
self.assertIsNotNone(is_absolute_uri('http://example.com/path'))
1918
self.assertIsNotNone(is_absolute_uri('http://example.com:80/path'))
20-
self.assertIsNotNone(is_absolute_uri('com.example.bundle.id:/'))
19+
20+
def test_query(self):
21+
self.assertIsNotNone(is_absolute_uri('http://example.com:80/path?foo'))
22+
self.assertIsNotNone(is_absolute_uri('http://example.com:80/path?foo=bar'))
23+
self.assertIsNotNone(is_absolute_uri('http://example.com:80/path?foo=bar&fruit=banana'))
24+
25+
def test_fragment_forbidden(self):
26+
self.assertIsNone(is_absolute_uri('http://example.com:80/path#foo'))
27+
self.assertIsNone(is_absolute_uri('http://example.com:80/path#foo=bar'))
28+
self.assertIsNone(is_absolute_uri('http://example.com:80/path#foo=bar&fruit=banana'))
29+
30+
def test_combined_forbidden(self):
31+
self.assertIsNone(is_absolute_uri('http://example.com:80/path?foo#bar'))
32+
self.assertIsNone(is_absolute_uri('http://example.com:80/path?foo&bar#fruit'))
33+
self.assertIsNone(is_absolute_uri('http://example.com:80/path?foo=1&bar#fruit=banana'))
34+
self.assertIsNone(is_absolute_uri('http://example.com:80/path?foo=1&bar=2#fruit=banana&bar=foo'))
35+
36+
def test_custom_scheme(self):
37+
self.assertIsNotNone(is_absolute_uri('com.example.bundle.id://'))
38+
39+
def test_ipv6_bracket(self):
2140
self.assertIsNotNone(is_absolute_uri('http://[::1]:38432/path'))
2241
self.assertIsNotNone(is_absolute_uri('http://[::1]/path'))
2342
self.assertIsNotNone(is_absolute_uri('http://[fd01:0001::1]/path'))
2443
self.assertIsNotNone(is_absolute_uri('http://[fd01:1::1]/path'))
2544
self.assertIsNotNone(is_absolute_uri('http://[0123:4567:89ab:cdef:0123:4567:89ab:cdef]/path'))
45+
self.assertIsNotNone(is_absolute_uri('http://[0123:4567:89ab:cdef:0123:4567:89ab:cdef]:8080/path'))
46+
47+
@unittest.skip("ipv6 edge-cases not supported")
48+
def test_ipv6_edge_cases(self):
49+
self.assertIsNotNone(is_absolute_uri('http://2001:db8::'))
50+
self.assertIsNotNone(is_absolute_uri('http://::1234:5678'))
51+
self.assertIsNotNone(is_absolute_uri('http://2001:db8::1234:5678'))
52+
self.assertIsNotNone(is_absolute_uri('http://2001:db8:3333:4444:5555:6666:7777:8888'))
53+
self.assertIsNotNone(is_absolute_uri('http://2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF'))
54+
self.assertIsNotNone(is_absolute_uri('http://0123:4567:89ab:cdef:0123:4567:89ab:cdef/path'))
55+
self.assertIsNotNone(is_absolute_uri('http://::'))
56+
self.assertIsNotNone(is_absolute_uri('http://2001:0db8:0001:0000:0000:0ab9:C0A8:0102'))
57+
58+
@unittest.skip("ipv6 dual ipv4 not supported")
59+
def test_ipv6_dual(self):
60+
self.assertIsNotNone(is_absolute_uri('http://2001:db8:3333:4444:5555:6666:1.2.3.4'))
61+
self.assertIsNotNone(is_absolute_uri('http://::11.22.33.44'))
62+
self.assertIsNotNone(is_absolute_uri('http://2001:db8::123.123.123.123'))
63+
self.assertIsNotNone(is_absolute_uri('http://::1234:5678:91.123.4.56'))
64+
self.assertIsNotNone(is_absolute_uri('http://::1234:5678:1.2.3.4'))
65+
self.assertIsNotNone(is_absolute_uri('http://2001:db8::1234:5678:5.6.7.8'))
66+
67+
def test_ipv4(self):
2668
self.assertIsNotNone(is_absolute_uri('http://127.0.0.1:38432/'))
2769
self.assertIsNotNone(is_absolute_uri('http://127.0.0.1:38432/'))
2870
self.assertIsNotNone(is_absolute_uri('http://127.1:38432/'))
2971

72+
def test_failures(self):
3073
self.assertIsNone(is_absolute_uri('http://example.com:notaport/path'))
3174
self.assertIsNone(is_absolute_uri('wrong'))
3275
self.assertIsNone(is_absolute_uri('http://[:1]:38432/path'))
@@ -35,7 +78,7 @@ def test_is_absolute_uri(self):
3578
def test_recursive_regex(self):
3679
from datetime import datetime
3780
t0 = datetime.now()
38-
self.assertIsNone(is_absolute_uri('http://[::::::::::::::::::::::::::]/path'))
81+
is_absolute_uri('http://[::::::::::::::::::::::::::]/path')
3982
t1 = datetime.now()
4083
spent = t1 - t0
4184
self.assertGreater(0.1, spent.total_seconds(), "possible recursive loop detected")

0 commit comments

Comments
 (0)