cloudfoundry / cloudfoundry/uaa
Identity Zone Create/Update should validate subdomain
Open
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.6k
- Forks
- 844
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 27
Description
Now that we intend to use subdomain in the path to express target Zone, /z/{subdomain} we should properly validate the subdomain in the IdentityZone.subdomain payload to ensure it does not contain characters that can lead to problems generating a URL
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the IdentityZone.subdomain payload handling and the code that generates the /z/{subdomain} path. Trace how the value is accepted and used, then add coverage showing that unsafe URL characters are rejected while valid subdomains remain accepted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100