review fixes

backend/src/services/identity-oci-auth/identity-oci-auth-service.ts

@@ -1,6 +1,7 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 import { ForbiddenError } from "@casl/ability";
 import jwt from "jsonwebtoken";
+import RE2 from "re2";
 
 import { IdentityAuthMethod } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -58,6 +59,13 @@ export const identityOciAuthServiceFactory = ({
 
     await blockLocalAndPrivateIpAddresses(headers.host);
 
+    // Validate OCI host format
+    if (!headers.host || !new RE2("^identity\\.[a-zA-Z0-9-]+\\.oraclecloud\\.com$").test(headers.host)) {
+      throw new BadRequestError({
+        message: "Invalid OCI host format. Expected format: identity.<region>.oraclecloud.com"
+      });
+    }
+
     const { data } = await request.get<TOciGetUserResponse>(`https://${headers.host}/20160918/users/${userOcid}`, {
       headers
     });
@@ -209,7 +217,7 @@ export const identityOciAuthServiceFactory = ({
 
     if (
       (accessTokenMaxTTL || identityOciAuth.accessTokenMaxTTL) > 0 &&
-      (accessTokenTTL || identityOciAuth.accessTokenMaxTTL) > (accessTokenMaxTTL || identityOciAuth.accessTokenMaxTTL)
+      (accessTokenTTL || identityOciAuth.accessTokenTTL) > (accessTokenMaxTTL || identityOciAuth.accessTokenMaxTTL)
     ) {
       throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
     }

backend/src/services/identity-oci-auth/identity-oci-auth-validators.ts

@@ -1,13 +1,14 @@
+import RE2 from "re2";
 import { z } from "zod";
 
 const usernameSchema = z
   .string()
   .min(1, "Username cannot be empty")
-  .regex(/^[a-zA-Z0-9._@-]+$/, "Invalid OCI username format");
-
+  .refine((val) => new RE2("^[a-zA-Z0-9._@-]+$").test(val), "Invalid OCI username format");
 export const validateUsernames = z
   .string()
   .trim()
+  .max(500, "Input exceeds the maximum limit of 500 characters")
   .transform((val) =>
     val
       .split(",")