fix: Validate OAuth HTTPS redirect URIs are subdomains of the client domain #2421
Open
ginger
wants to merge 1 commit from
ginger/validate-oauth-redirect-uri into main
pull from: ginger/validate-oauth-redirect-uri
merge into: continuwuation:main
continuwuation:main
continuwuation:renovate/node-26.x
continuwuation:renovate/ruma-digest
continuwuation:renovate/crate-tokio-vulnerability
continuwuation:renovate/serde-saphyr-2.x
continuwuation:renovate/sentry-rust-monorepo
continuwuation:renovate/tower-sec-fetch-0.x
continuwuation:renovate/parking_lot-0.x
continuwuation:renovate/p256-0.x
continuwuation:renovate/lock_api-0.x
continuwuation:nex/fix/gapfill-pdu-format
continuwuation:aranje/illegal-car-mods
continuwuation:nex/feat/intuitive-extremity-tracking
continuwuation:nex/feat/lockfree-event-builder
continuwuation:nex/fix/local-event-current-state
continuwuation:ginger/client-credentials
continuwuation:jade/deadlocks
continuwuation:nex/feat/notary-server
continuwuation:nex/feat/admin-api
continuwuation:nex/refactor/ruma-state-res
continuwuation:jade/mass-rename
continuwuation:nex/feat/msc-fed-bidi-ping
continuwuation:nex/feat/centralise-remote-memberships
continuwuation:morgan/arm64-runner
continuwuation:renovate/argon2-0.x
continuwuation:next/meta/disable-ci-build-cache
continuwuation:fix/26.7.3
continuwuation:1235-add-arm-deb
continuwuation:nex/meta/release-schedule
continuwuation:nex/feat/pdu-versions
continuwuation:ginger/revert-direct-tls
continuwuation:nex/fix/federated-invite-revoke
continuwuation:nex/fix/plunger
continuwuation:jade/perf/gme-rebased
continuwuation:nex/perf/get-missing-events2
continuwuation:nex/backport/v0.5.11
continuwuation:nex/backport/v0.5.10-backport
continuwuation:nex/feat/msc4491-invite-reasons-in-room-creation
continuwuation:nex/feat/deprecated-room-versions
continuwuation:release/v0.5.9
continuwuation:nex/feat/enable-debug-log-release-builds
continuwuation:nex/feat/room-purging
continuwuation:nex/feat/room-shutdown
continuwuation:ginger/ruma-upstreaming
continuwuation:jade/tls-backends
continuwuation:ginger/email-fixes
continuwuation:jade/changelog-labels
continuwuation:nex/fix/v12-publishing
continuwuation:jade/build-info
continuwuation:jade/purge-sync-tokens
continuwuation:ginger/terms-and-conditions
continuwuation:ginger/remove-sliding-sync-proxy
continuwuation:nex/fix/pusher-association
continuwuation:ginger/email-support
continuwuation:jade/community-guidelines
continuwuation:nex/fix/federation-format
continuwuation:jade/git-deps-updates
continuwuation:jade/changelog-check
continuwuation:jade/rust-1-92
continuwuation:ginger/password-reset
continuwuation:nex/experiment/push-gateway-logs
continuwuation:ginger/msc3575-obliteration
continuwuation:nex/feat/block-busted-rooms
continuwuation:nex/fix/informative-startup-errs
continuwuation:ginger/no-left-room-initial-sync
continuwuation:jade/docker-entrypoint
continuwuation:jade/dehydrated-devices
continuwuation:ginger/complement-fixes
continuwuation:nex/fix/stale-destination-cache
continuwuation:nex/experiment/sync-mutex
continuwuation:tcpipuk/docker-docs
continuwuation:jade/snafu
continuwuation:jade/rand-update
continuwuation:nex/stateres-refactor
continuwuation:ginger/779-in-troubleshooting
continuwuation:jade/liveit-guide
continuwuation:jade/http3
continuwuation:nex/feat/admin-hide-empty-rooms
continuwuation:ginger/oobe
continuwuation:nex/fix/debian-thingy
continuwuation:jade/ldap-admin-check
continuwuation:nex/fix/remote-restricted-joins
continuwuation:nex/feat/msc4406-sender-ignored
continuwuation:jade/deadlock-detection
continuwuation:jade/get-started
continuwuation:jade/docs-guide
continuwuation:ginger/fix-local-invites
continuwuation:nex/fix/tpi
continuwuation:nex/feat/room-deletion
continuwuation:nex/feat/msc4322-media-redaction
continuwuation:ginger/stitched-order
continuwuation:ginger/deps/update-rspress
continuwuation:jade/admin-announce-improvements
continuwuation:ginger/xtask-improvements
continuwuation:jade/improve-admin-config-display
continuwuation:nex/fix/better-stateres-error-logs
continuwuation:jade/sender-timeouts
continuwuation:nex/feat/custom-v12-room-ids
continuwuation:ginger/update-metadata
continuwuation:nex/feat/admin-force-logout
continuwuation:tom/max-perf-docs
continuwuation:nex/fix/invalid-appservice-reg
continuwuation:nex/feat/antispam
continuwuation:nex/feat/account-locking
continuwuation:jade/logging-cleanup
continuwuation:jade/remove-legacy-appservice-auth
continuwuation:nex/fix/key-query
continuwuation:jade/update-prek
continuwuation:nex/fix/room-summaries
continuwuation:ginger/restrict-admin-commands
continuwuation:ginger/enable-console-by-default
continuwuation:jade/tag-fixes
continuwuation:jade/otlp
continuwuation:nex/meta/pull-req-template
continuwuation:nex/fix/fed-invite-compliance
continuwuation:nex/feat/build-commit
continuwuation:nex/feat/join-logging
continuwuation:jade/mailmap-updates
continuwuation:jade/hack-ci-tmp
continuwuation:jade/v12-stable
continuwuation:jade/relations
continuwuation:ginger/database-refactor
continuwuation:jade/fix-ldap-uiaa
continuwuation:nex/fix/validation
continuwuation:ginger/nuke-invalid-msc4133-fields-in-migration
continuwuation:ginger/downgrade-artifact-actions
continuwuation:oddlid/reload-fix
continuwuation:jade/fix-assert
continuwuation:ginger/sync-v3-cleanup
continuwuation:ginger/remove-absolute-action-urls
continuwuation:jade/website
continuwuation:nex/fix/backoff
continuwuation:ginger/fix-mdbook-for-0.5
continuwuation:ginger/no-docker-on-prs
continuwuation:backport/v0.5.0-rc.8-1
continuwuation:nex/fed-improvements
continuwuation:jade/rust-1.90
continuwuation:jade/mirror-dockerhub
continuwuation:jade/clippy-fixes
continuwuation:jade/fix-support
continuwuation:jade/clean-images
continuwuation:jade/wal-compression-type
continuwuation:jade/flake-clone
continuwuation:ginger/upload-rpms-on-schedule
continuwuation:nex/fix/incoming-fetch
continuwuation:nex/fix/upgrade
continuwuation:tom/ci-fedora-rpm
continuwuation:jade/ci-release-fix
continuwuation:jade/rocksdb-10-5
continuwuation:ginger/fix-msc4133-migration
continuwuation:ginger/migrate-busted-tz
continuwuation:hydra/public
continuwuation:nex/feat/manual-extremities
continuwuation:nex/feat/async-media
continuwuation:nex/feat/fast-joins-hack-do-not-use-DO-NOT-USE
continuwuation:nex/feat/better-logging
continuwuation:trigger-ci-so-latest-isnt-on-illegal-car-mods
continuwuation:nex/feat/pins-backfill
continuwuation:jade/tuwunel-2025-06-old
continuwuation:jade/ai-slop-db-docs
continuwuation:nex/fix-create-auth
continuwuation:jade/version-stats
continuwuation:jade/read-receipts
continuwuation:jade/rust-toolchain-no-targets
continuwuation:jade/logging-features
continuwuation:jade/syncv5-typing
continuwuation:jade/msc2815
continuwuation:morguldir/see-eye
continuwuation:jade/css-small-screen
continuwuation:nex/wip-751
continuwuation:tuwunel-rebase
continuwuation:test
continuwuation:oddlid/rename-admin-room-bot
continuwuation:strawberry/nix-ci-stuff
continuwuation:strawberry/valgrind
continuwuation:phonemain
continuwuation:strawberry/morgs-snake-sync-jason-main
continuwuation:newer-media-endpoints
continuwuation:folly-coroutines-async-io
continuwuation:federation-retry-timer-port
continuwuation:bad-attempt-at-extracting-homeserver-signing-key
continuwuation:room-deletion-attempt-do-not-use
2026-10-27
fix: Validate OAuth HTTPS redirect URIs are subdomains of the client domain
Some checks failed
Auto Labeler / Apply labels based on changed files (pull_request_target) Successful in 8s
Checks / Prek / Check changed files (pull_request) Successful in 12s
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 18s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m10s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m15s
Checks / Prek / Clippy and Cargo Tests (pull_request) Failing after 42m25s