From 7c3225289862d952411ba3e551835204bc181b19 Mon Sep 17 00:00:00 2001 From: StuartFerguson Date: Fri, 18 Sep 2026 07:18:44 +0100 Subject: [PATCH] missed code review fix :| --- .../Oidc/OidcRequestHandler.cs | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/SecurityService.BusinessLogic/Oidc/OidcRequestHandler.cs b/SecurityService.BusinessLogic/Oidc/OidcRequestHandler.cs index 14bb343..98857ad 100644 --- a/SecurityService.BusinessLogic/Oidc/OidcRequestHandler.cs +++ b/SecurityService.BusinessLogic/Oidc/OidcRequestHandler.cs @@ -359,13 +359,21 @@ private async Task CompleteAuthorization( private bool MatchesOriginalRequest(HttpContext context, ConsentTransaction transaction) { - if (!Uri.TryCreate(transaction.AuthorizationUrl, UriKind.Relative, out var originalUri) || - !string.Equals(originalUri.AbsolutePath, context.Request.PathBase + context.Request.Path, StringComparison.Ordinal)) + var queryStart = transaction.AuthorizationUrl.IndexOf('?'); + var originalPath = queryStart >= 0 + ? transaction.AuthorizationUrl[..queryStart] + : transaction.AuthorizationUrl; + + if (string.IsNullOrEmpty(originalPath) || + originalPath[0] != '/' || + transaction.AuthorizationUrl.Contains('#', StringComparison.Ordinal) || + !string.Equals(originalPath, context.Request.PathBase + context.Request.Path, StringComparison.Ordinal)) { return false; } - var original = QueryHelpers.ParseQuery(originalUri.Query); + var originalQuery = queryStart >= 0 ? transaction.AuthorizationUrl[queryStart..] : string.Empty; + var original = QueryHelpers.ParseQuery(originalQuery); foreach (var pair in original) { if (!context.Request.Query.TryGetValue(pair.Key, out var current) || !current.SequenceEqual(pair.Value))