# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1684268199 -7200
# Node ID 9156a4754466dcfe2c17334f6e522d21a10f0f57
# Parent  9008aea491bfde3526d57ce6412ee8aa86f37e96
mod_http_oauth2: Reject relative redirect URIs

Also prevents a nil scheme from causing trouble

diff -r 9008aea491bf -r 9156a4754466 mod_http_oauth2/mod_http_oauth2.lua
--- a/mod_http_oauth2/mod_http_oauth2.lua	Tue May 16 21:10:55 2023 +0200
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Tue May 16 22:16:39 2023 +0200
@@ -807,6 +807,9 @@
 
 local function redirect_uri_allowed(redirect_uri, client_uri, app_type)
 	local uri = url.parse(redirect_uri);
+	if not uri.scheme then
+		return false; -- no relative URLs
+	end
 	if app_type == "native" then
 		return uri.scheme == "http" and loopbacks:contains(uri.host) or uri.scheme ~= "https";
 	elseif app_type == "web" then