fix: URL-encode OAuth error message in redirect URL (#22415)

- URL-encodes the OAuth error message when constructing the redirect URL in the OIDC callback handler
- Without encoding, error messages containing spaces, ampersands, or other special characters produce malformed URLs that the frontend cannot parse correctly
- The custom OAuth client callback handler already correctly uses urllib.parse.quote_plus() for the same purpose; this fix brings the OIDC handler in line with that pattern

Co-authored-by: gambletan <tan@gambletan.com>
This commit is contained in:
Ethan T.
2026-03-09 05:47:47 +08:00
committed by GitHub
parent 138c4cbfcf
commit a97f5adf95

View File

@@ -1706,7 +1706,7 @@ class OAuthManager:
redirect_url = f"{redirect_base_url}/auth"
if error_message:
redirect_url = f"{redirect_url}?error={error_message}"
redirect_url = f"{redirect_url}?error={urllib.parse.quote_plus(error_message)}"
return RedirectResponse(url=redirect_url, headers=response.headers)
response = RedirectResponse(url=redirect_url, headers=response.headers)