# HG changeset patch # User Kim Alvefur # Date 1724947403 -7200 # Node ID e8bf46a7bb27e9ee864b612eeadf82dfae2db112 # Parent 97375a78d2b58c649ef6669c864fa5920cf4794c mod_http_oauth2: Ensure URL ports are integer in correct range LuaSocket is weird and thinks ports should be strings diff -r 97375a78d2b5 -r e8bf46a7bb27 mod_http_oauth2/mod_http_oauth2.lua --- a/mod_http_oauth2/mod_http_oauth2.lua Thu Aug 29 16:02:46 2024 +0200 +++ b/mod_http_oauth2/mod_http_oauth2.lua Thu Aug 29 18:03:23 2024 +0200 @@ -32,6 +32,12 @@ local url_parts = url.parse(urlstr); if not url_parts then return url_parts; end if url_parts.userinfo then return false; end + if url_parts.port then + local port = tonumber(url_parts.port); + if not port then return false; end + if not (port > 0 and port <= 0xffff) then return false; end + if port ~= math.floor(port) then return false; end + end return url_parts; end