Allow private-use URI schemes in redirect URI validation (#356)

Author: cicnavi

src/Forms/ClientForm.php

@@ -33,11 +33,12 @@ class ClientForm extends Form
     protected const string TYPE_ARRAY = 'array';
 
     /**
-     * RFC3986. AppendixB. Parsing a URI Reference with a Regular Expression.
-     * From v6.*, the regex was modified to allow URI without host, to support adding entries like
-     * `openid-credential-offer://`
+     * URI with an RFC3986 compliant scheme, followed by any non-whitespace characters. Since the scheme may be
+     * followed by an empty authority component, entries like `openid-credential-offer://` (OID4VCI) or
+     * `app.example:///oauth-callback` (RFC8252 private-use URI scheme) are allowed. Scheme alone (`https:`) is not.
+     * Fragment component is not allowed, since response parameters are appended as query (OIDC Core, 3.1.2.1).
      */
-    final public const string REGEX_URI = '/^[^:]+:\/\/?([^\s\/$.?#].[^\s]*)?$/';
+    final public const string REGEX_URI = '/^[a-zA-Z][a-zA-Z0-9+\-.]*:(\/\/[^\s#]*|[^\s#]+)$/';
 
     /**
      * Must have http:// or https:// scheme, and at least one 'domain.top-level-domain' pair, or more subdomains.

tests/unit/src/Forms/ClientFormTest.php

@@ -191,6 +191,25 @@ public static function redirectUriProvider(): array
             ['openid-credential-offer://', true],
             ['foo://', true],
             ['https://', true],
+
+            // Private-use URI schemes for native apps (RFC8252), with empty authority component
+            ['app.immich:///oauth-callback', true],
+            ['com.example.app:/oauth2redirect/example-provider', true],
+            ['com.example.app:oauth2redirect', true],
+            ['urn:ietf:wg:oauth:2.0:oob', true],
+            ['x://a', true],
+
+            // Scheme must comply with RFC3986, and no whitespace is allowed
+            ['1foo://example.com', false],
+            ['foo bar://example.com', false],
+            ['  https://example.com', false],
+            ['https://example.com/foo bar', false],
+            ['://example.com', false],
+
+            // Fragment component is not allowed (OIDC Core, 3.1.2.1)
+            ['https://example.com/foo#bar', false],
+            ['com.example.app:#oauth2redirect', false],
+            ['app.immich:///oauth-callback#foo', false],
         ];
     }