oidc: enforce generic URI regex for the ACR value

Restrict the acr-value regex a little bit so as to align the behavior
with PBS. The openid documentation says that the acr-value *should* be
an URI [0]. Added a regex that loosely disallows some of the reserved
URI characters specified in the RFC [1].

Values like:
 * "urn:mace:incommon:iap:silver"
 * "urn:comsolve.nl:idp:contract:rba:location"
SHOULD work, but values like:
 * "urn:#ace:incommon:iap:silver"
 * "urn:"omsolve.nl:idp:contract:rba:location"
should NOT work.

This is related to the fix [2] for bug #5190 in PBS, but different as
there we had to make the verifier more flexible, whereas here we make
it stricter – mostly to have both projects aligned to avoid confusion.

[0]: https://openid.net/specs/openid-connect-core-1_0.html
[1]: https://www.rfc-editor.org/rfc/rfc2396.txt
[2]: https://git.proxmox.com/?p=proxmox-backup.git;a=commit;h=e0222ce83c28397d493c70825e873943c1223c67

Signed-off-by: Gabriel Goller <g.goller@proxmox.com>

diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm
index 56904e64e76d34230a20b5ea529d299bbdc47937..c8e4db930c148f147841f56b0bcdc53a449d1c88 100755 (executable)
--- a/src/PVE/Auth/OpenId.pm
+++ b/src/PVE/Auth/OpenId.pm
@@ -59,7 +59,8 @@ sub properties {
        'acr-values' => {
            description => "Specifies the Authentication Context Class Reference values that the"
                ."Authorization Server is being requested to use for the Auth Request.",
-           type => 'string', # format => 'some-safe-id-list', # FIXME: TODO
+           type => 'string',
+           pattern => '^[^\x00-\x1F\x7F <>#"]*$', # Prohibit characters not allowed in URI RFC 2396.
            optional => 1,
        },
    };