rusackas commented on code in PR #44036:
URL: https://github.com/apache/superset/pull/44036#discussion_r4057532546
##########
superset/commands/database/utils.py:
##########
@@ -135,6 +135,53 @@ def ssh_tunnel_rebind_unsafe(
return not has_fresh_credential or stale_private_key_password
+OAUTH2_ENDPOINT_FIELDS = (
+ "authorization_request_uri",
+ "token_request_uri",
+ "redirect_uri",
Review Comment:
redirect_uri isn't itself posted to, but it rides along in the
token-exchange body next to `client_secret`, and it's also the callback URL
handed to the browser during the auth step. An attacker-controlled value there
can still leak the authorization code, so I'd rather keep it in the same gate
than carve out an exception.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
