dkam/clinch
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix OIDC claims validation against undefined scopes variable

Browse Source 
The authorize action called validate_claims_against_scopes with
requested_scopes before that local was assigned (assignment was ~100
lines later), raising NameError whenever a client passed a claims=
parameter. Move the scope normalization above the claims validation.

Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>
This commit is contained in:
Dan Milne
2026-04-20 17:26:46 +10:00
parent 9197524c88
commit 17a464fd15
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
app/controllers/oidc_controller.rb
View File

@@ -168,6 +168,12 @@ class OidcController < ApplicationController
end end
end end
# Normalize requested scopes to the set we support. Needed here so claims
# validation below can check claim→scope coverage against what will actually
# be granted.
requested_scopes = scope.split(" ") & SUPPORTED_SCOPES
scope = requested_scopes.join(" ")
# Parse claims parameter (JSON string) for OIDC claims request # Parse claims parameter (JSON string) for OIDC claims request
# Per OIDC Core §5.5: The claims parameter is a JSON object that requests # Per OIDC Core §5.5: The claims parameter is a JSON object that requests
# specific claims to be returned in the id_token and/or userinfo # specific claims to be returned in the id_token and/or userinfo
@@ -291,9 +297,6 @@ class OidcController < ApplicationController
return return
end end
requested_scopes = scope.split(" ") & SUPPORTED_SCOPES
scope = requested_scopes.join(" ")
unless requested_scopes.include?("openid") unless requested_scopes.include?("openid")
error_uri = "#{redirect_uri}?error=invalid_scope&error_description=#{CGI.escape("The 'openid' scope is required")}" error_uri = "#{redirect_uri}?error=invalid_scope&error_description=#{CGI.escape("The 'openid' scope is required")}"
error_uri += "&state=#{CGI.escape(state)}" if state.present? error_uri += "&state=#{CGI.escape(state)}" if state.present?