From 0c4290261ec4b7a58c089cdbed6da0e4ef1919c9 Mon Sep 17 00:00:00 2001 From: BillionClaw Date: Sat, 18 Apr 2026 07:26:36 +0000 Subject: [PATCH] fix(auth): sanitize claims.sub when padding/truncating OIDC usernames When OIDC providers (e.g. Keycloak) use email addresses as usernames or when claims.sub contains @ or other invalid characters, the username padding and collision-suffix logic could introduce invalid characters. The fix filters claims.sub through the same allowed-character filter before using it in username construction. Fixes DioCrafts/OxiCloud#259 --- .../services/auth_application_service.rs | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/src/application/services/auth_application_service.rs b/src/application/services/auth_application_service.rs index 2ad22cfb..9dace7c3 100644 --- a/src/application/services/auth_application_service.rs +++ b/src/application/services/auth_application_service.rs @@ -1159,9 +1159,18 @@ impl AuthApplicationService { .take(32) .collect::(); - // Ensure minimum length + // Filter helper: removes any chars that are not valid in a username + let filter_username_chars = |s: &str| { + s.chars() + .filter(|c| c.is_ascii_alphanumeric() || *c == '-' || *c == '_' || *c == '.') + .take(32) + .collect::() + }; + + // Ensure minimum length (the padding suffix must also be filtered) if username.len() < 3 { - username = format!("user_{}", &claims.sub[..8.min(claims.sub.len())]); + let filtered_sub = filter_username_chars(&claims.sub); + username = format!("user_{}", &filtered_sub[..filtered_sub.len().min(8)]); } // Check for username collision @@ -1171,7 +1180,8 @@ impl AuthApplicationService { .await .is_ok() { - let suffix = &claims.sub[..4.min(claims.sub.len())]; + let filtered_sub = filter_username_chars(&claims.sub); + let suffix = &filtered_sub[..filtered_sub.len().min(4)]; username = format!("{}_{}", &username[..username.len().min(27)], suffix); }