fix: disallow relative url for issuer auth server

Signed-off-by: Pat Losoponkul <pat.losoponkul@iohk.io>
hyperledger · Sep 27, 2024 · e358d20 · e358d20
1 parent 8c565d7
commit e358d20
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/...rc/main/scala/org/hyperledger/identus/oid4vci/controller/CredentialIssuerController.scala b/...rc/main/scala/org/hyperledger/identus/oid4vci/controller/CredentialIssuerController.scala
@@ -127,8 +127,10 @@ case class CredentialIssuerControllerImpl(
 
   private def parseURL(url: String): IO[ErrorResponse, URL] =
     ZIO
-      .attempt(URI.create(url).toURL())
+      .attempt(URI.create(url))
       .mapError(ue => badRequest(detail = Some(s"Invalid URL: $url")))
+      .filterOrFail(_.isAbsolute())(badRequest(detail = Some(s"Relative URL '$url' is not allowed")))
+      .map(_.toURL())
 
   private def baseCredentialIssuerUrl(issuerId: UUID): URL =
     URI(s"$agentBaseUrl/oid4vci/issuers/$issuerId").toURL()