Enforce literal charactors in callback uri validation with a configuration

[ashanthamara]

Proposed changes in this pull request

This pull request updates the callback URI validation logic in the OAuth2 authorization request validator. The main change is an improvement to how regular expressions are handled to ensure more accurate matching of callback URIs.

Callback URI validation improvements:

• The code now escapes., ?, + in the regular expression only when they are followed by a letter or digit (e.g., .com, .org), which prevents unintended matches and avoids interfering with wildcard patterns like .* or .+ or .{n}. when the particular configuration is enabled
• The validation logic now checks for the presence of a regular expression: if none is provided, it falls back to a direct string comparison between the registered and provided callback URIs.
• Also adding a diagnostic log to identify the failing callback validations when the literal charactors are enforced, before enforcing the new behavior with the configuration

Changes derived from

• http://github.com/wso2-extensions/identity-inbound-auth-oauth/pull/2883

Depends on

• Add configuration to enforce literal charactors in callback url validation wso2/carbon-identity-framework#7351

[codecov]

Codecov Report

❌ Patch coverage is 90.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 57.81%. Comparing base (34cf007) to head (62a05d6).
⚠️ Report is 24 commits behind head on master.

Files with missing lines	Patch %	Lines
...lidators/AbstractResponseTypeRequestValidator.java	90.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #2900      +/-   ##
============================================
+ Coverage     56.08%   57.81%   +1.72%     
+ Complexity     9354     9088     -266     
============================================
  Files           669      669              
  Lines         53762    50708    -3054     
  Branches      11860    11226     -634     
============================================
- Hits          30155    29317     -838     
+ Misses        19378    17305    -2073     
+ Partials       4229     4086     -143     

Flag	Coverage Δ
unit	40.49% <90.00%> (+0.19%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull Request Overview

This pull request enhances OAuth2 callback URI validation by introducing configurable literal character enforcement in regular expressions. The main improvement addresses security concerns where regex special characters (., +, ?) could cause unintended matches in callback URI patterns.

• Adds configuration-driven literal character enforcement for regex validation
• Implements diagnostic logging to identify validation failures when literal enforcement would apply
• Updates test coverage to validate the new enforcement behavior across various callback URI scenarios

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
AbstractResponseTypeRequestValidator.java	Core implementation of configurable literal character enforcement and diagnostic logging
AbstractResponseTypeRequestValidatorCallbackURITest.java	Comprehensive test suite for the new callback URI validation logic
testng.xml	Test configuration update to include the new test class
OAuth2ServiceTest.java	Simplified existing test data provider by removing redundant test cases

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The word 'charactors' in the PR title should be 'characters'. Also, the comment should end with proper punctuation and formatting.

Suggested change

	Escape (.), (+), (?) only when followed by a letter/digit (so .com, .org, etc. get escaped),
	but don't touch .* or .+ or .{n} .
	Escape (.), (+), (?) only when followed by a letter/digit (so .com, .org, etc. get escaped),
	but don't touch .* or .+ or .{n}.