779cc5f · typeable/oauth2-proxy

CHANGELOG.md+1

@@ -14,6 +14,7 @@

14- [#3278](https://github.com/oauth2-proxy/oauth2-proxy/pull/3278) feat: possibility to inject id_token in redirect url during sign out (@albanf)

15- [#2851](https://github.com/oauth2-proxy/oauth2-proxy/pull/2851) feat: add support for specifying allowed OIDC JWT signing algorithms (#2753) (@andoks / @tuunit)

16- [#3369](https://github.com/oauth2-proxy/oauth2-proxy/pull/3369) fix: use CSRFExpire instead of Expire for CSRF cookie validation (@Br1an67)

17+- [#3365](https://github.com/oauth2-proxy/oauth2-proxy/pull/3365) fix: filter empty strings from allowed groups (@Br1an67)

17

18

18# V7.14.3

19# V7.14.3

19

20

providers/provider_data.go+4

@@ -194,6 +194,10 @@ func regexpForRule(rule options.URLParameterRule) string {

194func (p *ProviderData) setAllowedGroups(groups []string) {

195 p.AllowedGroups = make(map[string]struct{}, len(groups))

196 for _, group := range groups {

197+ if len(group) == 0 {

198+ continue

199+ }

200+

197 p.AllowedGroups[group] = struct{}{}

201 p.AllowedGroups[group] = struct{}{}

198 }

202 }

199}

203}

providers/provider_default_test.go+12

@@ -102,6 +102,18 @@ func TestProviderDataAuthorize(t *testing.T) {

102 groups: []string{"baz", "foo"},

103 expectedAuthZ: false,

104 },

105+ {

106+ name: "AllowedGroupsWithEmptyString",

107+ allowedGroups: []string{"group2", ""},

108+ groups: []string{"group1", "group2"},

109+ expectedAuthZ: true,

110+ },

111+ {

112+ name: "AllowedGroupsOnlyEmptyString",

113+ allowedGroups: []string{""},

114+ groups: []string{"group1", "group2"},

115+ expectedAuthZ: true,

116+ },

105 }

117 }

106

118

107 for _, tc := range testCases {

119 for _, tc := range testCases {