From 931e293a7b2033b9f51eac378b149189aca0b124 Mon Sep 17 00:00:00 2001
From: smarcet <smarcet@gmail.com>
Date: Wed, 7 Oct 2026 10:06:20 -0300
Subject: [PATCH 1/2] fix(validators): accept hyphenated hostnames with
 explicit port in sslurl

The host part of the sslurl regex did not allow '-' and the path part does
not allow ':', so any https URL with a hyphenated hostname and a port
(e.g. https://macbook-air.example.ts.net:10000/auth/callback) failed the
custom_url_set rule on redirect_uris / allowed_origins.
---
 app/Validators/CustomValidator.php       |  2 +-
 tests/unit/CustomUrlSetValidatorTest.php | 95 ++++++++++++++++++++++++
 2 files changed, 96 insertions(+), 1 deletion(-)
 create mode 100644 tests/unit/CustomUrlSetValidatorTest.php

diff --git a/app/Validators/CustomValidator.php b/app/Validators/CustomValidator.php
index 7012f4a8..a8d547f5 100644
--- a/app/Validators/CustomValidator.php
+++ b/app/Validators/CustomValidator.php
@@ -111,7 +111,7 @@ public function validateApplicationtype($attribute, $value)
 
     public function validateSslurl($attribute, $value)
     {
-        return preg_match(";^https:\/\/([\w@][\w.:@]+)\/?[\w\.?=%&=\-@/$,]*$;i", $value) == 1;
+        return preg_match(";^https:\/\/([\w@][\w.:@\-]+)\/?[\w\.?=%&=\-@/$,]*$;i", $value) == 1;
     }
 
     public function validateFreeText($attribute, $value)
diff --git a/tests/unit/CustomUrlSetValidatorTest.php b/tests/unit/CustomUrlSetValidatorTest.php
new file mode 100644
index 00000000..bd1628b8
--- /dev/null
+++ b/tests/unit/CustomUrlSetValidatorTest.php
@@ -0,0 +1,95 @@
+<?php namespace Tests\unit;
+
+/**
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+use Illuminate\Translation\ArrayLoader;
+use Illuminate\Translation\Translator;
+use OAuth2\Models\IClient;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Validators\CustomValidator;
+
+/**
+ * Class CustomUrlSetValidatorTest
+ *
+ * Regression: custom_url_set rejected https URLs whose hostname contains a hyphen
+ * AND carries an explicit port (e.g. https://macbook-air.example.ts.net:10000/auth/callback),
+ * because the host part of the sslurl regex did not allow '-' and the path part does not allow ':'.
+ *
+ * @package Tests\unit
+ */
+class CustomUrlSetValidatorTest extends TestCase
+{
+    private function validate(string $value, string $app_type = IClient::ApplicationType_JS_Client): bool
+    {
+        $data = ['redirect_uris' => $value, 'application_type' => $app_type];
+        $validator = new CustomValidator
+        (
+            new Translator(new ArrayLoader(), 'en'),
+            $data,
+            ['redirect_uris' => 'custom_url_set:application_type']
+        );
+        return $validator->passes();
+    }
+
+    public static function validUrlsProvider(): array
+    {
+        return [
+            'hyphenated host with port'      => ['https://macbook-air.tail3c93e5.ts.net:10000/auth/callback'],
+            'hyphenated host with port root' => ['https://macbook-air.tail3c93e5.ts.net:10000/'],
+            'hyphenated host without port'   => ['https://macbook-air.tail3c93e5.ts.net/auth/callback'],
+            'double hyphen host'             => ['https://pr-1031--show-admin-preview.netlify.app/auth/callback'],
+            'ip with port'                   => ['https://192.168.68.106:8080/auth/callback'],
+            'localhost with port'            => ['https://localhost:3000/auth/callback'],
+            'plain host'                     => ['https://showadmin.dev.fnopen.com/auth/callback'],
+        ];
+    }
+
+    #[DataProvider('validUrlsProvider')]
+    public function testAcceptsValidSslUrl(string $url): void
+    {
+        $this->assertTrue($this->validate($url), sprintf('%s should be accepted', $url));
+    }
+
+    public function testAcceptsCommaSeparatedSetWithHyphenatedHostAndPort(): void
+    {
+        $this->assertTrue($this->validate(implode(',', [
+            'https://localhost:8080/auth/callback',
+            'https://macbook-air.tail3c93e5.ts.net:10000/auth/callback',
+        ])));
+    }
+
+    public static function invalidUrlsProvider(): array
+    {
+        return [
+            'http scheme'                  => ['http://my-host.com:8080/cb'],
+            'no scheme'                    => ['my-host.com:8080/cb'],
+            'host starting with hyphen'    => ['https://-my-host.com:8080/cb'],
+        ];
+    }
+
+    #[DataProvider('invalidUrlsProvider')]
+    public function testRejectsInvalidSslUrl(string $url): void
+    {
+        $this->assertFalse($this->validate($url), sprintf('%s should be rejected', $url));
+    }
+
+    public function testRejectsSetWhenAnyUrlIsInvalid(): void
+    {
+        $this->assertFalse($this->validate(implode(',', [
+            'https://macbook-air.tail3c93e5.ts.net:10000/auth/callback',
+            'http://localhost:8080/auth/callback',
+        ])));
+    }
+}

From edda15ae506d1b25898b8498492d07f133d6fe0d Mon Sep 17 00:00:00 2001
From: smarcet <smarcet@gmail.com>
Date: Wed, 7 Oct 2026 10:22:47 -0300
Subject: [PATCH 2/2] fix(ui): accept hyphenated hostnames with explicit port
 in post logout uris

The post logout redirect URI validator in the edit client UI still used the
old sslurl regex, whose host part did not allow '-', so TagsInput silently
dropped URLs like https://macbook-air.example.ts.net:10000/logout even though
the API now accepts them.
---
 .../js/oauth2/profile/edit_client/components/logout_options.js  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/resources/js/oauth2/profile/edit_client/components/logout_options.js b/resources/js/oauth2/profile/edit_client/components/logout_options.js
index 113a2173..c05a2075 100644
--- a/resources/js/oauth2/profile/edit_client/components/logout_options.js
+++ b/resources/js/oauth2/profile/edit_client/components/logout_options.js
@@ -22,7 +22,7 @@ const LogoutOptions = ({appTypes, initialValues, onSavePromise}) => {
         if (initialValues.application_type === appTypes.Native) {
             return isValidNativeUri(value);
         }
-        const regex = /^https:\/\/([\w@][\w.:@]+)\/?[\w\.?=%&=\-@/$,]*$/ig;
+        const regex = /^https:\/\/([\w@][\w.:@\-]+)\/?[\w\.?=%&=\-@/$,]*$/ig;
         return regex.test(value);
     }