From c5ef5f77dde1c82265d8441533a4e9d324759c76 Mon Sep 17 00:00:00 2001 From: tanjiro Kamado Date: Thu, 22 Oct 2026 22:58:48 +0530 Subject: [PATCH 1/2] require https authorization endpoint in cupsOAuthMakeAuthorizationURL --- CHANGES.md | 2 ++ cups/oauth.c | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/CHANGES.md b/CHANGES.md index 2894a7773..ab4d7dde5 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -48,6 +48,8 @@ v3.0.4 - YYYY-MM-DD - Fixed a memory leak in `httpGetSecurity` when using GNU TLS. - Fixed a memory leak in `cupsJWTImportString`. - Fixed a bug in `cupsJWTExportString` with JSON output. +- Fixed `cupsOAuthMakeAuthorizationURL` to only accept HTTPS authorization + endpoints. v3.0.3 - 2026-08-20 diff --git a/cups/oauth.c b/cups/oauth.c index c66711d28..7411fb061 100644 --- a/cups/oauth.c +++ b/cups/oauth.c @@ -1651,6 +1651,14 @@ cupsOAuthMakeAuthorizationURL( if (!auth_uri || !metadata || (authorization_ep = cupsJSONGetString(cupsJSONFind(metadata, "authorization_endpoint"))) == NULL || !redirect_uri || !client_id) return (NULL); + // The authorization endpoint is opened in the user's web browser, so only + // allow HTTPS URLs (RFC 6749 section 3.1)... + if (strncmp(authorization_ep, "https://", 8)) + { + _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Authorization endpoint is not an HTTPS URL."), true); + return (NULL); + } + // Make the authorization URL using the information supplied... if (oauth_metadata_contains(metadata, "response_type_supported", "code id_token")) num_vars = cupsAddOption("response_type", "code id_token", num_vars, &vars); From 230274e45359f93488b324ea1cbcb81ffae7ecfa Mon Sep 17 00:00:00 2001 From: tanjiro Kamado Date: Sat, 24 Oct 2026 11:28:28 +0530 Subject: [PATCH 2/2] fold https check into range check and drop changelog entry --- CHANGES.md | 2 -- cups/oauth.c | 10 +--------- 2 files changed, 1 insertion(+), 11 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index ab4d7dde5..2894a7773 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -48,8 +48,6 @@ v3.0.4 - YYYY-MM-DD - Fixed a memory leak in `httpGetSecurity` when using GNU TLS. - Fixed a memory leak in `cupsJWTImportString`. - Fixed a bug in `cupsJWTExportString` with JSON output. -- Fixed `cupsOAuthMakeAuthorizationURL` to only accept HTTPS authorization - endpoints. v3.0.3 - 2026-08-20 diff --git a/cups/oauth.c b/cups/oauth.c index 7411fb061..9dfe62e4c 100644 --- a/cups/oauth.c +++ b/cups/oauth.c @@ -1648,17 +1648,9 @@ cupsOAuthMakeAuthorizationURL( // Range check input... - if (!auth_uri || !metadata || (authorization_ep = cupsJSONGetString(cupsJSONFind(metadata, "authorization_endpoint"))) == NULL || !redirect_uri || !client_id) + if (!auth_uri || !metadata || (authorization_ep = cupsJSONGetString(cupsJSONFind(metadata, "authorization_endpoint"))) == NULL || strncmp(authorization_ep, "https://", 8) || !redirect_uri || !client_id) return (NULL); - // The authorization endpoint is opened in the user's web browser, so only - // allow HTTPS URLs (RFC 6749 section 3.1)... - if (strncmp(authorization_ep, "https://", 8)) - { - _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Authorization endpoint is not an HTTPS URL."), true); - return (NULL); - } - // Make the authorization URL using the information supplied... if (oauth_metadata_contains(metadata, "response_type_supported", "code id_token")) num_vars = cupsAddOption("response_type", "code id_token", num_vars, &vars);