Add assertion to prevent illegal characters in tags

simplesamlphp · Nov 13, 2024 · 0d520fb · 0d520fb
1 parent edfe370
commit 0d520fb
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/PowerIdPDisco.php b/src/PowerIdPDisco.php
@@ -339,6 +339,13 @@ public function handleRequest(): void
         $t->data['rememberenabled'] = $this->config->getOptionalBoolean('idpdisco.enableremember', false);
         $t->data['rememberchecked'] = $this->config->getOptionalBoolean('idpdisco.rememberchecked', false);
         foreach (array_keys($idpList) as $tab) {
+            Assert::regex(
+                $tab,
+                '/^[a-z_][a-z0-9_-]+$/',
+                'Tags can contain alphanumeric characters, hyphens and underscores.'
+                . ' They must start with a A-Z or an underscore.',
+            );
+
             $translatableTag = "{discopower:tabs:$tab}";
             if ($translator::translateSingularGettext($translatableTag) === $translatableTag) {
                 $t->data['tabNames'][$tab] = $translator::noop($tab);