More secure redirect URIs

1 files changed, 10 insertions, 0 deletions

diff --git a/src/api/clients.rs b/src/api/clients.rs
index 27ef995..3f906bb 100644
--- a/src/api/clients.rs
+++ b/src/api/clients.rs
@@ -418,6 +418,16 @@ async fn update_client_redirect_uris(
 	let db = db.get_ref();
 	let id = *id;
 
+	for uri in body.0.iter() {
+		if uri.scheme() != "https" {
+			yeet!(CreateClientError::NonHttpsUri.into());
+		}
+
+		if uri.fragment().is_some() {
+			yeet!(CreateClientError::UriFragment.into())
+		}
+	}
+
 	if !db::client_id_exists(db, id).await.unwrap() {
 		yeet!(ClientNotFound::new(id).into());
 	}