fix(sso): patch JOSE security alerts and clarify redirect guards

.github/workflows/dependency-review.yml

@@ -0,0 +1,25 @@
+name: Dependency review
+
+on:
+  pull_request:
+    paths:
+      - go.mod
+      - go.sum
+      - web/package.json
+      - web/package-lock.json
+      - .github/workflows/dependency-review.yml
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/dependency-review-action@v5
+        with:
+          fail-on-severity: moderate
+          comment-summary-in-pr: never
+          license-check: false

go.mod

@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/coder/websocket v1.8.15
 	github.com/coreos/go-oidc/v3 v3.21.0
-	github.com/go-jose/go-jose/v4 v4.1.4
+	github.com/go-jose/go-jose/v4 v4.1.7
 	github.com/iniwex5/quectel-qmi-go v0.6.0
 	github.com/modelcontextprotocol/go-sdk v1.8.0
 	github.com/warthog618/sms v0.3.0

go.sum

@@ -9,8 +9,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.7 h1:Nac/98uT5LPkfbiFuYa8ktf62a2VxwQ4xbq1GK8pV5E=
+github.com/go-jose/go-jose/v4 v4.1.7/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=

internal/sso/jwks_security_test.go

@@ -0,0 +1,63 @@
+package sso
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"math/big"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-jose/go-jose/v4"
+)
+
+// TestJWKSRejectsOversizedRSAKeys exercises the dependency's resource limit
+// through our JWKS path without generating an oversized key or validating large primes.
+func TestJWKSRejectsOversizedRSAKeys(t *testing.T) {
+	valid, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+	public := jose.JSONWebKey{Key: &valid.PublicKey, KeyID: "valid", Use: "sig", Algorithm: string(jose.RS256)}
+	// A 4097-bit modulus is just above go-jose's default 4096-bit ceiling.
+	// The old dependency accepted this small JWK as a usable public key.
+	modulus := new(big.Int).Lsh(big.NewInt(1), 4096)
+	modulus.SetBit(modulus, 0, 1)
+	oversized := map[string]string{
+		"kty": "RSA", "kid": "oversized", "use": "sig", "alg": string(jose.RS256),
+		"n": base64.RawURLEncoding.EncodeToString(modulus.Bytes()), "e": "AQAB",
+	}
+	for _, tc := range []struct {
+		name         string
+		includeValid bool
+	}{
+		{name: "oversized key only"},
+		{name: "mixed set retains usable key", includeValid: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			keys := []any{oversized}
+			if tc.includeValid {
+				keys = append(keys, public)
+			}
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if err := json.NewEncoder(w).Encode(map[string]any{"keys": keys}); err != nil {
+					t.Error(err)
+				}
+			}))
+			defer server.Close()
+			set := &callbackKeySet{url: server.URL, client: server.Client(), algorithms: []jose.SignatureAlgorithm{jose.RS256}}
+			fetched, err := set.fetch(context.Background())
+			if !tc.includeValid {
+				if !errors.Is(err, ErrProviderUnavailable) || len(fetched) != 0 {
+					t.Fatalf("oversized RSA key accepted: keys=%d error=%v", len(fetched), err)
+				}
+			} else if err != nil || len(fetched) != 1 || fetched[0].KeyID != public.KeyID {
+				t.Fatalf("mixed JWKS did not retain only its usable key: keys=%d error=%v", len(fetched), err)
+			}
+		})
+	}
+}

internal/sso/redirect.go

@@ -12,7 +12,10 @@ var ambiguousPathEscape = regexp.MustCompile(`(?i)%(?:2f|5c|2e|25|0[0-9a-f]|1[0-
 // SafeRedirect accepts an already parsed redirect parameter. It never decodes
 // query values a second time and preserves the original query and fragment.
 func SafeRedirect(value, origin string) string {
-	if value == "" || len(value) > 4096 || !strings.HasPrefix(value, "/") || strings.HasPrefix(value, "//") {
+	// Keep the authority check explicit: browsers treat both // and /\ as
+	// network-path references, so a leading slash alone is not sufficient.
+	if len(value) == 0 || len(value) > 4096 || value[0] != '/' ||
+		(len(value) > 1 && (value[1] == '/' || value[1] == '\\')) {
 		return "/"
 	}
 	for _, character := range value {

web/test/fixtures/ssoRedirect.json

@@ -2,20 +2,30 @@
   {"input": null, "expected": "/"},
   {"input": "", "expected": "/"},
   {"input": "/", "expected": "/"},
+  {"input": "/?next=//evil.example#latest", "expected": "/?next=//evil.example#latest"},
+  {"input": "/?next=%2F%5C%25#latest", "expected": "/?next=%2F%5C%25#latest"},
+  {"input": "/#//evil.example", "expected": "/#//evil.example"},
   {"input": "/devices/modem-1?tab=sms#latest", "expected": "/devices/modem-1?tab=sms#latest"},
   {"input": "/sms?keyword=%E6%B5%8B%E8%AF%95", "expected": "/sms?keyword=%E6%B5%8B%E8%AF%95"},
   {"input": "/sms?next=%252F%252Fevil.example#latest", "expected": "/sms?next=%252F%252Fevil.example#latest"},
   {"input": "/sms?value=%2F%5C%2E%25", "expected": "/sms?value=%2F%5C%2E%25"},
   {"input": "https://evil.example/", "expected": "/"},
   {"input": "//evil.example/", "expected": "/"},
+  {"input": "//vocat.example.com/settings", "expected": "/"},
   {"input": "///evil.example/", "expected": "/"},
   {"input": "javascript:alert(1)", "expected": "/"},
   {"input": "/\\evil.example/", "expected": "/"},
+  {"input": "/\t/evil.example/", "expected": "/"},
+  {"input": "/\r/evil.example/", "expected": "/"},
+  {"input": "/\n/evil.example/", "expected": "/"},
   {"input": "/%5cevil.example/", "expected": "/"},
+  {"input": "/%255cevil.example/", "expected": "/"},
   {"input": "/%2f%2fevil.example/", "expected": "/"},
   {"input": "/%252f%252fevil.example/", "expected": "/"},
   {"input": "/%2e%2e//evil.example/", "expected": "/"},
   {"input": "/a/..//evil.example/", "expected": "/"},
+  {"input": "/.//evil.example/", "expected": "/"},
+  {"input": "/%09/evil.example/", "expected": "/"},
   {"input": "/%00foo", "expected": "/"},
   {"input": "/%1fabc", "expected": "/"},
   {"input": "/%7fabc", "expected": "/"},