fix: avoid exposing validation details in oauth client registration errors

app/apps/common/oauth_views.py

@@ -1,5 +1,6 @@
 import hmac
 import json
+import logging
 import time
 from secrets import token_urlsafe
 
@@ -12,6 +13,7 @@ from oauth2_provider.models import get_application_model
 
 
 Application = get_application_model()
+logger = logging.getLogger(__name__)
 
 SUPPORTED_TOKEN_ENDPOINT_AUTH_METHODS = {
     "none": Application.CLIENT_PUBLIC,
@@ -145,7 +147,8 @@ def dynamic_client_registration(request):
             default=["code"],
         )
     except ValueError as exc:
-        return _json_error("invalid_client_metadata", str(exc))
+        logger.warning("Invalid dynamic client registration payload: %s", exc)
+        return _json_error("invalid_client_metadata", "Client metadata is invalid.")
 
     unsupported_grant_types = sorted(set(grant_types) - SUPPORTED_GRANT_TYPES)
     if unsupported_grant_types:
@@ -223,12 +226,10 @@ def dynamic_client_registration(request):
     try:
         application.full_clean()
     except ValidationError as exc:
-        errors = []
-        for field, messages in exc.message_dict.items():
-            errors.extend(f"{field}: {message}" for message in messages)
+        logger.warning("Dynamic client registration validation failed: %s", exc)
         return _json_error(
             "invalid_client_metadata",
-            "; ".join(errors),
+            "Client metadata is invalid.",
         )
 
     application.save()

frontend/package-lock.json

@@ -28,7 +28,7 @@
         "htmx.org": "^2.0.10",
         "hyperscript.org": "^0.9.91",
         "mathjs": "^15.2.0",
-        "postcss": "^8.5.25",
+        "postcss": "^8.5.15",
         "pulltorefreshjs": "^0.1.22",
         "sass": "^1.100.0",
         "sweetalert2": "^11.26.25",
@@ -1758,9 +1758,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.12",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
+      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
       "funding": [
         {
           "type": "github",
@@ -1810,9 +1810,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.25",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz",
-      "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==",
+      "version": "8.5.15",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
+      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
       "funding": [
         {
           "type": "opencollective",
@@ -1829,7 +1829,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.16",
+        "nanoid": "^3.3.12",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },

frontend/package.json

@@ -35,7 +35,7 @@
     "htmx.org": "^2.0.10",
     "hyperscript.org": "^0.9.91",
     "mathjs": "^15.2.0",
-    "postcss": "^8.5.25",
+    "postcss": "^8.5.15",
     "pulltorefreshjs": "^0.1.22",
     "sass": "^1.100.0",
     "sweetalert2": "^11.26.25",