Escape user and group names in issued tokens (PelicanPlatform#1494)

jhiemstrawisc · Dec 6, 2024 · bc2f2b2 · bc2f2b2
1 parent db96b8b
commit bc2f2b2
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/oa4mp/resources/policies.qdl b/oa4mp/resources/policies.qdl
@@ -35,12 +35,12 @@ scopes := {};
 while [has_value(key, group_list.)]
 [
     group_scopes := { {{- range $idx, $action := .Actions }}{{- if eq $idx 0 -}}'{{- $action -}}:'{{else}}, '{{- $action -}}:'{{- end -}}{{ end -}} } + '{{- .Prefix -}}';
-    scopes := scopes \/ |^replace(~group_scopes, '$GROUP', key);
+    scopes := scopes \/ |^replace(~group_scopes, '$GROUP', encode(key, 1)); /* 1 = URL-encode (RFC 3986) */
 ];
 {{- end }}
 {{ range .UserAuthzTemplates }}
 user_scopes := { {{- range $idx, $action := .Actions }}{{- if eq $idx 0 -}}'{{- $action -}}:'{{else}}, '{{- $action -}}:'{{- end -}}{{ end -}} } + '{{- .Prefix -}}';
-scopes := scopes \/ |^replace(~user_scopes, '$USER', claims.'sub');
+scopes := scopes \/ |^replace(~user_scopes, '$USER', encode(claims.'sub', 1)); /* 1 = URL-encode (RFC 3986) */
 {{ end }}
 access_token.'scope' := detokenize(scopes, ' ', 2);