extra input checks

webapp/src/Auth/AuthBanner.tsx

@@ -14,7 +14,7 @@ import {
 import classes from './AuthBanner.module.css';
 import { useMutation, useQuery } from '@tanstack/react-query';
 import axios from 'axios';
-import { AppSettings } from '../Constants/Constants';
+import { AppSettings, UUID_REGEX } from '../Constants/Constants';
 import { useAuthContext } from './Auth';
 import { AuthError } from './AuthError';
 import { MFAInput } from './MFAInput';
@@ -90,7 +90,14 @@ export function AuthBanner() {
     }
   })
   const onClickOidcRedirect = (id: string) => {
-    window.location.href = AppSettings.url + '/authmethods/oidc/' + id + "/redirect"
+    if (!UUID_REGEX.test(id)) {
+      setAuthError("Invalid OIDC method id (expected UUID)");
+      return;
+    }
+
+    const safeId = encodeURIComponent(id);
+
+    window.location.href = AppSettings.url + '/authmethods/oidc/' + safeId + "/redirect"
   }
 
   const captureEnter = (e: React.KeyboardEvent<HTMLDivElement>) => {

webapp/src/Auth/OIDCAndSAMLRedirect.tsx

@@ -1,14 +1,20 @@
-import { useEffect } from "react";
-import { AppSettings } from "../Constants/Constants";
+import { useEffect, useState } from "react";
+import { AppSettings, UUID_REGEX } from "../Constants/Constants";
 import { useMatch } from "react-router-dom";
 
 export function OIDCAndSAMLRedirect() {
+  const [redirectError, setRedirectError] = useState<string>("")
   const loginMatch = useMatch("/login/:loginType/:loginID");
 
   useEffect(() => {
     if (loginMatch && loginMatch.params.loginType !== undefined && loginMatch.params.loginID !== undefined) {
-      window.location.href = AppSettings.url + '/authmethods/' + loginMatch.params.loginType + '/' + loginMatch.params.loginID + "/redirect"
+      if (!UUID_REGEX.test(loginMatch.params.loginID)) {
+        setRedirectError("Invalid OIDC method id (expected UUID)");
+        return;
+      }
+      window.location.href = AppSettings.url + '/authmethods/' + encodeURIComponent(loginMatch.params.loginType) + '/' + encodeURIComponent(loginMatch.params.loginID) + "/redirect"
     }
   }, []);
+  if (redirectError !== "") return <p>{redirectError}</p>
   return (<></>)
 }

webapp/src/Constants/Constants.tsx

@@ -4,4 +4,7 @@ interface Settings {
 
 export var AppSettings: Settings = {
     url: "/api",
-}
+}
+
+export const UUID_REGEX =
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;