Allow non-URL-safe characters in email addresses #22
Conversation
…n used in emails like [email protected] Fix redirection error when impersonating a tenant with an email containing non-URL-safe characters
Allow non-URL-safe characters in email addresses
WalkthroughThe changes in this pull request involve a modification to the Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Outside diff range and nitpick comments (1)
src/Filament/Resources/TenantResource.php (1)
142-144: Consider improving URL construction robustness.While the current implementation works, consider these improvements for better maintainability and reliability:
- Use Laravel's URL builder instead of string concatenation
- Add null check for domains array access
- Consider centralizing the URL construction logic
Here's a suggested refactor:
- return redirect()->to(request()->getScheme()."://".$record->domains[0]->domain.'.'. config('filament-tenancy.central_domain') . '/login/url?token='.$token->token .'&email='. urlencode($record->email)); + $domain = $record->domains->first()?->domain ?? throw new \RuntimeException('Tenant has no domain'); + return redirect()->to( + URL::format( + '%s://%s.%s/login/url', + request()->getScheme(), + $domain, + config('filament-tenancy.central_domain') + ) . '?' . http_build_query([ + 'token' => $token->token, + 'email' => $record->email, + ]) + );
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
src/Filament/Resources/TenantResource.php(1 hunks)
🔇 Additional comments (1)
src/Filament/Resources/TenantResource.php (1)
141-144: Verify security measures for impersonation.
The impersonation feature has good security controls but consider these additional safeguards:
- Add explicit token expiration time
- Consider rate limiting impersonation attempts
- Add audit logging for impersonation events
Let's check for existing security measures:
#!/bin/bash
# Description: Verify security measures around impersonation
# Check for rate limiting implementations
rg -g '*.php' "throttle|RateLimiter"
# Look for audit logging implementations
rg -g '*.php' "activity|audit|log"
# Check token expiration settings
rg -g '*.php' "impersonate.*expire|expire.*token"| @@ -140,7 +140,7 @@ public static function table(Table $table): Table | |||
| ->action(function ($record){ | |||
| $token = tenancy()->impersonate($record, 1, '/app', 'web'); | |||
|
|
|||
| return redirect()->to(request()->getScheme()."://".$record->domains[0]->domain.'.'. config('filament-tenancy.central_domain') . '/login/url?token='.$token->token .'&email='. $record->email); | |||
| return redirect()->to(request()->getScheme()."://".$record->domains[0]->domain.'.'. config('filament-tenancy.central_domain') . '/login/url?token='.$token->token .'&email='. urlencode($record->email)); | |||
There was a problem hiding this comment.
💡 Codebase verification
Similar email parameters in other files need URL encoding
The verification revealed three other files with the same URL construction pattern that don't URL encode the email parameter:
src/Livewire/RegisterOtp.phpsrc/Livewire/RegisterDemo.phpsrc/Http/Controllers/AuthController.php
These locations should also apply urlencode() to the email parameter to maintain consistency and prevent potential issues with special characters.
🔗 Analysis chain
LGTM! URL encoding fix properly handles special characters.
The addition of urlencode() correctly addresses the issue with non-URL-safe characters in email addresses during tenant impersonation.
Let's verify the complete URL handling:
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check for other potential URL encoding issues in the codebase
# Look for direct email concatenation in URLs that might need encoding
# Search for URL patterns with potential email concatenation
rg -g '*.php' "(\?|&)email=[^&'\"]+"
# Search for other URL parameters that might need encoding
rg -g '*.php' "->to\([^)]+\+"
Length of output: 9523
Script:
#!/bin/bash
# Let's try a more specific search for URL construction patterns
# Search for URL construction with email parameters
rg -g '*.php' -A 2 -B 2 'login/url\?.*email'
# Search for similar redirect patterns in the codebase
rg -g '*.php' -A 2 -B 2 'redirect\(\)->to\(.*token.*email'
Length of output: 4085
Fix redirection error when impersonating a tenant with an email containing non-URL-safe characters, such as the
+sign used in emails like[email protected]Summary by CodeRabbit