141 lines
3.5 KiB
Go
141 lines
3.5 KiB
Go
package telegramlogin
|
|
|
|
import (
|
|
"net"
|
|
"net/url"
|
|
"strconv"
|
|
"strings"
|
|
"unicode"
|
|
|
|
"golang.org/x/net/idna"
|
|
|
|
"telesrv/internal/domain"
|
|
)
|
|
|
|
const maxTelegramLoginURLLength = 4096
|
|
|
|
func NormalizeRedirectURI(raw string, allowLoopbackHTTP bool) (normalized, domainName string, err error) {
|
|
u, err := parseWebURL(raw, allowLoopbackHTTP)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
if u.Fragment != "" {
|
|
return "", "", domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
query := u.Query()
|
|
for _, reserved := range []string{"code", "state", "error", "error_description"} {
|
|
if _, exists := query[reserved]; exists {
|
|
return "", "", domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
}
|
|
if u.Path == "" {
|
|
u.Path = "/"
|
|
}
|
|
return u.String(), u.Hostname(), nil
|
|
}
|
|
|
|
func NormalizeWebOrigin(raw string, allowLoopbackHTTP bool) (string, error) {
|
|
u, err := parseWebURL(raw, allowLoopbackHTTP)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if (u.Path != "" && u.Path != "/") || u.RawQuery != "" || u.Fragment != "" || u.RawPath != "" {
|
|
return "", domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
u.Path = ""
|
|
return u.String(), nil
|
|
}
|
|
|
|
func parseWebURL(raw string, allowLoopbackHTTP bool) (*url.URL, error) {
|
|
if raw == "" || len(raw) > maxTelegramLoginURLLength || raw != strings.TrimSpace(raw) || strings.IndexFunc(raw, unicode.IsControl) >= 0 {
|
|
return nil, domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
u, err := url.Parse(raw)
|
|
if err != nil || !u.IsAbs() || u.Opaque != "" || u.User != nil || u.Host == "" {
|
|
return nil, domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
u.Scheme = strings.ToLower(u.Scheme)
|
|
host := strings.TrimSuffix(strings.ToLower(u.Hostname()), ".")
|
|
if host == "" {
|
|
return nil, domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
if ip := net.ParseIP(host); ip == nil {
|
|
host, err = idna.Lookup.ToASCII(host)
|
|
if err != nil || host == "" {
|
|
return nil, domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
}
|
|
port := u.Port()
|
|
if port != "" {
|
|
n, err := strconv.Atoi(port)
|
|
if err != nil || n < 1 || n > 65535 {
|
|
return nil, domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
}
|
|
switch u.Scheme {
|
|
case "https":
|
|
if port == "443" {
|
|
port = ""
|
|
}
|
|
case "http":
|
|
if !allowLoopbackHTTP || !isLoopbackHost(host) {
|
|
return nil, domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
if port == "80" {
|
|
port = ""
|
|
}
|
|
default:
|
|
return nil, domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
if port == "" {
|
|
if ip := net.ParseIP(host); ip != nil && strings.Contains(host, ":") {
|
|
u.Host = "[" + host + "]"
|
|
} else {
|
|
u.Host = host
|
|
}
|
|
} else {
|
|
u.Host = net.JoinHostPort(host, port)
|
|
}
|
|
return u, nil
|
|
}
|
|
|
|
func isLoopbackHost(host string) bool {
|
|
if host == "localhost" {
|
|
return true
|
|
}
|
|
ip := net.ParseIP(host)
|
|
return ip != nil && ip.IsLoopback()
|
|
}
|
|
|
|
func AppendAuthorizationResult(redirectURI, code, state string) (string, error) {
|
|
u, err := url.Parse(redirectURI)
|
|
if err != nil || !u.IsAbs() || code == "" {
|
|
return "", domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
q := u.Query()
|
|
q.Set("code", code)
|
|
if state != "" {
|
|
q.Set("state", state)
|
|
}
|
|
u.RawQuery = q.Encode()
|
|
return u.String(), nil
|
|
}
|
|
|
|
func AppendAuthorizationError(redirectURI, errorCode, state string) (string, error) {
|
|
switch errorCode {
|
|
case "access_denied", "temporarily_unavailable", "server_error", "invalid_request", "invalid_scope", "unsupported_response_type":
|
|
default:
|
|
return "", domain.ErrTelegramLoginRequestInvalid
|
|
}
|
|
u, err := url.Parse(redirectURI)
|
|
if err != nil || !u.IsAbs() {
|
|
return "", domain.ErrTelegramLoginURLInvalid
|
|
}
|
|
q := u.Query()
|
|
q.Set("error", errorCode)
|
|
if state != "" {
|
|
q.Set("state", state)
|
|
}
|
|
u.RawQuery = q.Encode()
|
|
return u.String(), nil
|
|
}
|