oauth validation: improve redirect checking
Add these improvements:
check that the redirect URI is not empty
check valid group name of the redirect ref
report the right path in the validation error
@@ -12,6 +12,7 @@ import (
"k8s.io/apiserver/pkg/authentication/serviceaccount"
"k8s.io/kubernetes/pkg/apis/core/validation"
+ routev1 "github.com/openshift/api/route/v1"
authorizerscopes "github.com/openshift/origin/pkg/authorization/authorizer/scope"
oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
"github.com/openshift/origin/pkg/oauthserver/authenticator/password/bootstrap"
@@ -49,7 +50,7 @@ func ValidateTokenName(name string, prefix bool) []string {
func ValidateRedirectURI(redirect string) (bool, string) {
if len(redirect) == 0 {
- return true, ""
+ return false, "may not be empty"
}
u, err := url.Parse(redirect)
@@ -374,26 +375,31 @@ func ValidateScopes(scopes []string, fldPath *field.Path) field.ErrorList {
func ValidateOAuthRedirectReference(sref *oauthapi.OAuthRedirectReference) field.ErrorList {
allErrs := validation.ValidateObjectMeta(&sref.ObjectMeta, true, path.ValidatePathSegmentName, field.NewPath("metadata"))
- return append(allErrs, validateRedirectReference(&sref.Reference)...)
+ return append(allErrs, validateRedirectReference(&sref.Reference, field.NewPath("reference"))...)
}
-func validateRedirectReference(ref *oauthapi.RedirectReference) field.ErrorList {
+func validateRedirectReference(ref *oauthapi.RedirectReference, fldPath *field.Path) field.ErrorList {
allErrs := field.ErrorList{}
if len(ref.Name) == 0 {
- allErrs = append(allErrs, field.Required(field.NewPath("name"), "may not be empty"))
+ allErrs = append(allErrs, field.Required(fldPath.Child("name"), "may not be empty"))
} else {
for _, msg := range path.ValidatePathSegmentName(ref.Name, false) {
- allErrs = append(allErrs, field.Invalid(field.NewPath("name"), ref.Name, msg))
+ allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), ref.Name, msg))
}
}
switch ref.Kind {
case "":
- allErrs = append(allErrs, field.Required(field.NewPath("kind"), "may not be empty"))
+ allErrs = append(allErrs, field.Required(fldPath.Child("kind"), "may not be empty"))
case "Route":
// Valid, TODO add ingress once we support it and update error message
default:
- allErrs = append(allErrs, field.Invalid(field.NewPath("kind"), ref.Kind, "must be Route"))
+ allErrs = append(allErrs, field.Invalid(fldPath.Child("kind"), ref.Kind, "must be Route"))
+ }
+ switch ref.Group {
+ case "", routev1.GroupName:
+ // valid group names
+ default:
+ allErrs = append(allErrs, field.NotSupported(fldPath.Child("group"), ref.Group, []string{"", routev1.GroupName}))
}
- // TODO validate group once we start using it
return allErrs
}
