feat: update scim/core to implement RFC-7643 - #2746
Conversation
6580640 to
80ec271
Compare
11e0e54 to
ee648cd
Compare
This comment has been minimized.
This comment has been minimized.
074458e to
f9a435a
Compare
f9a435a to
a7c9b2d
Compare
fec7a7d to
218f257
Compare
a7c9b2d to
368471e
Compare
368471e to
9a4b646
Compare
7ce31be to
a9ac782
Compare
![depthfirst-app[bot]](https://avatars.githubusercontent.com/in/1021002?s=60&v=4){kind=small}
|
|
||
| func (m Meta) For(resource Resource) Meta { | ||
| created, updated := resource.Timestamps() | ||
| m.Location = Join(m.Location, resource.ResourceID()) |
There was a problem hiding this comment.
⚪ Severity: LOW
resource.ResourceID() is copied into the SCIM meta.location URL as a raw path fragment. A client- or directory-derived identifier containing /, ?, #, or .. can change the referenced path or query, causing SCIM consumers following this location to request an unintended resource or operation.
Helpful? Add 👍 / 👎
💡 Fix Suggestion
Suggestion: URL-encode the resource ID before appending it to the SCIM meta.location URL to prevent path traversal and URL manipulation via special characters. Use url.PathEscape(resource.ResourceID()) at line 23, and also expand the import at line 3 to include "net/url" alongside "time". url.PathEscape will percent-encode characters such as /, ?, #, and .. so they are treated as literal data in the path segment rather than URL structure.
⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.
| m.Location = Join(m.Location, resource.ResourceID()) | |
| m.Location = Join(m.Location, url.PathEscape(resource.ResourceID())) |
a96cfe7 to
fc3d2c3
Compare
fc3d2c3 to
29c862c
Compare
|
|
||
| import "strings" | ||
|
|
||
| type Kind struct { |
There was a problem hiding this comment.
nit: this is subjective so please feel free to ignore — I find that "kind" a bit overloaded and seeing it in method signatures doesn't immediately signal what it's about.
Would it make sense to merge this with Resource (internal/api/scim/core/resource.go or internal/api/scim/core/resource_type.go)?
There was a problem hiding this comment.
I agree. I struggled with this type because I was trying to glue together concepts that don't really fit. I'm going to try dropping it and try Resource because I think that might fit better.
|
I'm closing this in favour of #2747. The SCIM core/protocol code has been moved to https://github.com/supabase-community/scim-go. |
2 participants
What kind of change does this PR introduce?
Feature. Implements RFC-7643 SCIM Core Schema.
What is the current behavior?
What is the new behavior?
Additional context
Extracted from #2731