feat: update scim/core to implement RFC-7643 - #2746
Conversation
11e0e54 to
ee648cd
Compare
This comment has been minimized.
This comment has been minimized.
fec7a7d to
218f257
Compare
7ce31be to
a9ac782
Compare
![depthfirst-app[bot]](https://avatars.githubusercontent.com/in/1021002?s=60&v=4){kind=small}
|
|
||
| func (m Meta) For(resource Resource) Meta { | ||
| created, updated := resource.Timestamps() | ||
| m.Location = Join(m.Location, resource.ResourceID()) |
There was a problem hiding this comment.
⚪ Severity: LOW
resource.ResourceID() is copied into the SCIM meta.location URL as a raw path fragment. A client- or directory-derived identifier containing /, ?, #, or .. can change the referenced path or query, causing SCIM consumers following this location to request an unintended resource or operation.
Helpful? Add 👍 / 👎
💡 Fix Suggestion
Suggestion: URL-encode the resource ID before appending it to the SCIM meta.location URL to prevent path traversal and URL manipulation via special characters. Use url.PathEscape(resource.ResourceID()) at line 23, and also expand the import at line 3 to include "net/url" alongside "time". url.PathEscape will percent-encode characters such as /, ?, #, and .. so they are treated as literal data in the path segment rather than URL structure.
⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.
| m.Location = Join(m.Location, resource.ResourceID()) | |
| m.Location = Join(m.Location, url.PathEscape(resource.ResourceID())) |
1 participant
What kind of change does this PR introduce?
Feature. Implements RFC-7643 SCIM Core Schema.
What is the current behavior?
What is the new behavior?
Additional context
Extracted from #2731