From ba8092fac7c56ebc98ee10a02ce72b32f2472ef1 Mon Sep 17 00:00:00 2001 From: Bjarke Berg Date: Fri, 15 Nov 2024 09:40:26 +0100 Subject: [PATCH] Fixes https://github.com/umbraco/Umbraco-CMS/issues/17506 (#17536) Now the validation of ClientId has a max of 255 characters --- .../ClientCredentials/ClientCredentialsUserControllerBase.cs | 2 +- src/Umbraco.Core/Services/UserService.cs | 2 +- .../Umbraco.Infrastructure/Services/UserServiceTests.cs | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/Umbraco.Cms.Api.Management/Controllers/User/ClientCredentials/ClientCredentialsUserControllerBase.cs b/src/Umbraco.Cms.Api.Management/Controllers/User/ClientCredentials/ClientCredentialsUserControllerBase.cs index 1751564b37..deeb8d8f0d 100644 --- a/src/Umbraco.Cms.Api.Management/Controllers/User/ClientCredentials/ClientCredentialsUserControllerBase.cs +++ b/src/Umbraco.Cms.Api.Management/Controllers/User/ClientCredentials/ClientCredentialsUserControllerBase.cs @@ -20,7 +20,7 @@ public abstract class ClientCredentialsUserControllerBase : UserControllerBase .Build()), BackOfficeUserClientCredentialsOperationStatus.InvalidClientId => BadRequest(problemDetailsBuilder .WithTitle("Invalid client ID") - .WithDetail("The specified client ID is invalid. A valid client ID can only contain [a-z], [A-Z], [0-9], and [-._~].") + .WithDetail("The specified client ID is invalid. A valid client ID can only contain [a-z], [A-Z], [0-9], and [-._~]. Furthermore, including the prefix it cannot be longer than 255 characters.") .Build()), _ => StatusCode(StatusCodes.Status500InternalServerError, problemDetailsBuilder .WithTitle("Unknown client credentials operation status.") diff --git a/src/Umbraco.Core/Services/UserService.cs b/src/Umbraco.Core/Services/UserService.cs index 3463516cc2..9eb5a3e5bb 100644 --- a/src/Umbraco.Core/Services/UserService.cs +++ b/src/Umbraco.Core/Services/UserService.cs @@ -2677,7 +2677,7 @@ internal partial class UserService : RepositoryService, IUserService } } - [GeneratedRegex(@"^[\w\d\-\._~]*$")] + [GeneratedRegex(@"^[\w\d\-\._~]{1,255}$")] private static partial Regex ValidClientId(); #endregion diff --git a/tests/Umbraco.Tests.Integration/Umbraco.Infrastructure/Services/UserServiceTests.cs b/tests/Umbraco.Tests.Integration/Umbraco.Infrastructure/Services/UserServiceTests.cs index e20fcb5310..92829fdf37 100644 --- a/tests/Umbraco.Tests.Integration/Umbraco.Infrastructure/Services/UserServiceTests.cs +++ b/tests/Umbraco.Tests.Integration/Umbraco.Infrastructure/Services/UserServiceTests.cs @@ -1004,6 +1004,7 @@ public class UserServiceTests : UmbracoIntegrationTest [TestCase("@", UserClientCredentialsOperationStatus.InvalidClientId)] [TestCase("[", UserClientCredentialsOperationStatus.InvalidClientId)] [TestCase("]", UserClientCredentialsOperationStatus.InvalidClientId)] + [TestCase("More_Than_255_characters_012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789", UserClientCredentialsOperationStatus.InvalidClientId)] public async Task Can_Use_Only_Unreserved_Characters_For_ClientId(string clientId, UserClientCredentialsOperationStatus expectedResult) { // Arrange