git.iko.soy/typeable/oauth2-proxy
on master help sign in
fix: filter empty strings from allowed groups (#3365)

* fix: filter empty strings from allowed groups When parsing allowed groups from configuration (e.g., via environment variable OAUTH2_PROXY_ALLOWED_GROUPS), viper may include empty strings in the parsed slice when trailing commas are present (e.g., "group2," becomes ["group2", ""]). The setAllowedGroups function now filters out empty strings before adding them to the AllowedGroups map, ensuring that only valid group names are checked during authorization. Fixes #3123 Signed-off-by: Br1an67 <932039080@qq.com> * refactor: minor change Signed-off-by: Jan Larwig <jan@larwig.com> * doc: add changelog entry for 3365 Signed-off-by: Jan Larwig <jan@larwig.com> --------- Signed-off-by: Br1an67 <932039080@qq.com> Signed-off-by: Jan Larwig <jan@larwig.com> Co-authored-by: Jan Larwig <jan@larwig.com>

commit779cc5f350951b67169aec9836b3495f4faf80df authorBr1an <932039080@qq.com> dateWed 18 Mar 2026, 22:44 (6 months ago) parentff357da
3 files changed+17
compare with master
unifiedsplit
CHANGELOG.md+1 providers/provider_data.go+4 providers/provider_default_test.go+12
CHANGELOG.md+1
@@ -14,6 +14,7 @@
1414- [#3278](https://github.com/oauth2-proxy/oauth2-proxy/pull/3278) feat: possibility to inject id_token in redirect url during sign out (@albanf)
1515- [#2851](https://github.com/oauth2-proxy/oauth2-proxy/pull/2851) feat: add support for specifying allowed OIDC JWT signing algorithms (#2753) (@andoks / @tuunit)
1616- [#3369](https://github.com/oauth2-proxy/oauth2-proxy/pull/3369) fix: use CSRFExpire instead of Expire for CSRF cookie validation (@Br1an67)
17+- [#3365](https://github.com/oauth2-proxy/oauth2-proxy/pull/3365) fix: filter empty strings from allowed groups (@Br1an67)
1718
1819# V7.14.3
1920
providers/provider_data.go+4
@@ -194,6 +194,10 @@ func regexpForRule(rule options.URLParameterRule) string {
194194func (p *ProviderData) setAllowedGroups(groups []string) {
195195 p.AllowedGroups = make(map[string]struct{}, len(groups))
196196 for _, group := range groups {
197+ if len(group) == 0 {
198+ continue
199+ }
200+
197201 p.AllowedGroups[group] = struct{}{}
198202 }
199203}
providers/provider_default_test.go+12
@@ -102,6 +102,18 @@ func TestProviderDataAuthorize(t *testing.T) {
102102 groups: []string{"baz", "foo"},
103103 expectedAuthZ: false,
104104 },
105+ {
106+ name: "AllowedGroupsWithEmptyString",
107+ allowedGroups: []string{"group2", ""},
108+ groups: []string{"group1", "group2"},
109+ expectedAuthZ: true,
110+ },
111+ {
112+ name: "AllowedGroupsOnlyEmptyString",
113+ allowedGroups: []string{""},
114+ groups: []string{"group1", "group2"},
115+ expectedAuthZ: true,
116+ },
105117 }
106118
107119 for _, tc := range testCases {