diff --git a/src/Core/Models/Api/Request/Organizations/OrganizationSsoRequestModel.cs b/src/Core/Models/Api/Request/Organizations/OrganizationSsoRequestModel.cs
index e08b19004e..66319f47bf 100644
--- a/src/Core/Models/Api/Request/Organizations/OrganizationSsoRequestModel.cs
+++ b/src/Core/Models/Api/Request/Organizations/OrganizationSsoRequestModel.cs
@@ -159,6 +159,25 @@ namespace Bit.Core.Models.Api
yield return new ValidationResult(i18nService.GetLocalizedHtmlString("IdpSingleSignOnServiceUrlValidationError"),
new[] { nameof(IdpSingleSignOnServiceUrl) });
}
+
+ if (ContainsHtmlMetaCharacters(IdpSingleSignOnServiceUrl))
+ {
+ yield return new ValidationResult(i18nService.GetLocalizedHtmlString("IdpSingleSignOnServiceUrlInvalid"),
+ new[] { nameof(IdpSingleSignOnServiceUrl) });
+ }
+
+ if (ContainsHtmlMetaCharacters(IdpArtifactResolutionServiceUrl))
+ {
+ yield return new ValidationResult(i18nService.GetLocalizedHtmlString("IdpArtifactResolutionServiceUrlInvalid"),
+ new[] { nameof(IdpArtifactResolutionServiceUrl) });
+ }
+
+ if (ContainsHtmlMetaCharacters(IdpSingleLogoutServiceUrl))
+ {
+ yield return new ValidationResult(i18nService.GetLocalizedHtmlString("IdpSingleLogoutServiceUrlInvalid"),
+ new[] { nameof(IdpSingleLogoutServiceUrl) });
+ }
+
if (!string.IsNullOrWhiteSpace(IdpX509PublicCert))
{
// Validate the certificate is in a valid format
@@ -240,5 +259,14 @@ namespace Bit.Core.Models.Api
string.Empty,
RegexOptions.Multiline | RegexOptions.IgnoreCase | RegexOptions.CultureInvariant);
}
+
+ private bool ContainsHtmlMetaCharacters(string url)
+ {
+ if (string.IsNullOrWhiteSpace(url))
+ {
+ return false;
+ }
+ return Regex.IsMatch(url, "[<>\"]");
+ }
}
}
diff --git a/src/Core/Resources/SharedResources.en.resx b/src/Core/Resources/SharedResources.en.resx
index 55e8525454..57f09f5a93 100644
--- a/src/Core/Resources/SharedResources.en.resx
+++ b/src/Core/Resources/SharedResources.en.resx
@@ -442,19 +442,19 @@
Request ID
-
+
Redirecting
-
+
You are now being returned to the application. Once complete, you may close this tab.
-
+
If IdP Wants Authn Requests Signed
-
+
Always
-
+
Never
@@ -466,33 +466,33 @@
The IdP public certificate provided does not appear to be a valid certificate, please ensure this is a valid, Base64 encoded PEM or CER format public certificate valid for signing: {0}
-
+
Copy the OIDC callback path to your clipboard
-
+
Copy the OIDC signed out callback path to your clipboard
-
+
Copy the SP Entity Id to your clipboard
-
+
Copy the SAML 2.0 Metadata URL to your clipboard
-
+
View the SAML 2.0 Metadata (opens in a new window)
-
+
Copy the Assertion Consumer Service (ACS) URL to your clipboard
-
+
Redirect
A SAML binding type, Redirect
-
+
HTTP POST
A SAML binding type, HTTP POST
-
+
Artifact
A SAML binding type, Artifact
@@ -667,4 +667,13 @@
Require new users to be enrolled automatically
-
+
+ Artifact resolution service URL contains illegal characters.
+
+
+ Single log out service URL contains illegal characters.
+
+
+ Single sign on service URL contains illegal characters.
+
+
\ No newline at end of file