Harden issuer-path scope and fix review nits

Follow-up to the OIDC device-flow review, four minor items:

- isEndpointUnderIssuerPath now scans for an encoded path separator at
  every decode level, not just the raw string, and rejects a literal
  backslash. A split encoding such as %2%66 (which resolves to %2f then
  '/') and a backslash folded to '/' by decodePathSegments previously
  passed the single-pass pre-scan and could make a deeper endpoint
  masquerade as being under the pinned issuer path while a different raw
  path travelled on the wire. The origin pin already kept credentials on
  the trusted host, so this closes a defense-in-depth gap, not an exploit.

- close()'s Javadoc no longer claims a hard one-HTTP-timeout bound: a
  DeviceCodePrompt that blocks in promptUser (the default browser launch)
  holds the lock while it runs, so a racing close() waits it out too.

- testOutOfRangePollIntervalAndExpiryAreClamped now asserts the exact
  clamped values (60s interval, 1800s device-code lifetime) instead of
  bounds 5x and 2x looser than the real maxima.

- Move the JsonLexer hasEscape field to its alphabetical position.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glasstiger

core/src/main/java/io/questdb/client/cutlass/auth/OidcDeviceAuth.java

@@ -89,7 +89,9 @@
  * {@link OidcAuthException} rather than polling until the device code expires. Cancellation is seen
  * between polls (within ~100ms while waiting out an interval); a poll already in flight is not
  * interrupted, so the abort - and {@link #close()} - can take up to one HTTP request timeout (see
- * {@link Builder#httpTimeoutMillis(int)}), still far short of the device-code lifetime.
+ * {@link Builder#httpTimeoutMillis(int)}), still far short of the device-code lifetime (a
+ * {@link DeviceCodePrompt} that blocks in {@code promptUser}, such as the default browser launch, can
+ * extend that wait by however long it runs).
  * <p>
  * Instances are interactive and hold a network connection; close them when done. Token state is
  * in-memory only and does not survive a process restart.
@@ -380,8 +382,12 @@ public void clearCache() {
      * between polls (within ~100ms while waiting out a poll interval); a poll request already in flight
      * is not interrupted, so {@code close()} acquires the lock - and returns - only once that request
      * finishes or times out, i.e. after at most one HTTP request timeout
-     * (see {@link Builder#httpTimeoutMillis(int)}), not the full device-code lifetime. Idempotent. After
-     * close, {@link #getToken()} and {@link #clearCache()} throw.
+     * (see {@link Builder#httpTimeoutMillis(int)}), not the full device-code lifetime. The exception is a
+     * {@link DeviceCodePrompt} that blocks in {@code promptUser} - for example the default
+     * {@link DeviceCodePrompt#openBrowser()} prompt while it hands the verification URL to the OS browser,
+     * which is not bounded by the HTTP timeout: the flow holds the lock across that one-off prompt, so a
+     * racing {@code close()} waits it out too. Idempotent. After close, {@link #getToken()} and
+     * {@link #clearCache()} throw.
      */
     @Override
     public void close() {
@@ -574,6 +580,37 @@ private static OidcAuthException endpointNotUnderIssuer(String label, String url
                 .put("explicitly with OidcDeviceAuth.builder()");
     }
 
+    private static boolean endpointPathHasEncodedSeparator(String rawEndpointPath) {
+        // Scan for a literal backslash (decodePathSegments folds it to '/') or a percent-encoded path
+        // separator - %2f ('/'), %5c ('\'), or an encoded percent %25 that gates a split or double encoding
+        // such as %2%66 or %252f - at every decode level, not just the raw string. A separator that only
+        // emerges after the server unescapes more than once would pass a single-pass scan yet split one
+        // segment in two, letting .../realms/acme%2%66evil/token slip the issuer-path scope. A real OIDC
+        // endpoint path encodes none of these. Bounded like decodePathSegments; a real path needs 0-1 passes.
+        String decoded = rawEndpointPath;
+        for (int pass = 0; pass < 10; pass++) {
+            for (int i = 0, n = decoded.length(); i < n; i++) {
+                char c = decoded.charAt(i);
+                if (c == '\\') {
+                    return true;
+                }
+                if (c == '%' && i + 2 < n) {
+                    char a = decoded.charAt(i + 1);
+                    char b = decoded.charAt(i + 2);
+                    if ((a == '2' && (b == 'f' || b == 'F' || b == '5')) || (a == '5' && (b == 'c' || b == 'C'))) {
+                        return true;
+                    }
+                }
+            }
+            String next = percentDecodeOnce(decoded);
+            if (next.equals(decoded)) {
+                break;
+            }
+            decoded = next;
+        }
+        return false;
+    }
+
     private static void fetchJson(Endpoint endpoint, String path, ClientTlsConfiguration tlsConfig, JsonParser parser, String reachError, String parseError) {
         HttpClient client = endpoint.isTls
                 ? HttpClientFactory.newTlsInstance(HTTP_CONFIG, tlsConfig)
@@ -661,18 +698,11 @@ private static boolean isEndpointUnderIssuerPath(String endpointUrl, String issu
         }
         String[] baseSegs = decodePathSegments(basePath.substring(0, baseEnd));
         String rawEndpointPath = pathOnly(endpointUrl);
-        // reject a percent-encoded path separator - %2f ('/'), %5c ('\'), or a double-encoded form flagged by
-        // an encoded percent %25 (e.g. %252f). decodePathSegments resolves it before the segment comparison,
-        // so it would split one path segment in two and could let .../realms/acme%2fevil/token slip the
-        // issuer-path scope. A real OIDC endpoint path never encodes a separator.
-        for (int i = 0, n = rawEndpointPath.length() - 2; i < n; i++) {
-            if (rawEndpointPath.charAt(i) == '%') {
-                char a = rawEndpointPath.charAt(i + 1);
-                char b = rawEndpointPath.charAt(i + 2);
-                if ((a == '2' && (b == 'f' || b == 'F' || b == '5')) || (a == '5' && (b == 'c' || b == 'C'))) {
-                    return false;
-                }
-            }
+        // A real OIDC endpoint path never encodes a path separator or uses a backslash; reject either before
+        // the segment comparison, since decodePathSegments resolves them and would split one path segment in
+        // two, letting .../realms/acme%2fevil/token (or its split/backslash forms) slip the issuer-path scope.
+        if (endpointPathHasEncodedSeparator(rawEndpointPath)) {
+            return false;
         }
         String[] endpointSegs = decodePathSegments(rawEndpointPath);
         // a "." or ".." segment is rejected outright: the server normalizes it away, so a naive prefix test

core/src/main/java/io/questdb/client/cutlass/json/JsonLexer.java

@@ -60,11 +60,11 @@ public class JsonLexer implements Mutable, Closeable {
     private long cache;
     private int cacheCapacity;
     private int cacheSize = 0;
+    private boolean hasEscape = false;
     private boolean ignoreNext = false;
     private int objDepth = 0;
     private int position = 0;
     private boolean quoted = false;
-    private boolean hasEscape = false;
     private int state = S_START;
     private boolean useCache = false;
 

core/src/test/java/io/questdb/client/test/cutlass/auth/OidcDeviceAuthTest.java

@@ -1918,6 +1918,21 @@ public void testIssuerPathScopingRejectsSiblingRealm() throws Exception {
         });
     }
 
+    @Test(timeout = 30_000)
+    public void testIssuerPathScopingRejectsSplitEncodedAndBackslashSeparators() throws Exception {
+        // hardening: an encoded path separator can hide behind a SPLIT encoding (%2%66 -> %2f -> '/') or a
+        // double encoding (%252f), and a literal backslash is folded to '/' by decodePathSegments. Each lets an
+        // extra segment masquerade as being under the issuer path while a different raw path travels on the
+        // wire, so isEndpointUnderIssuerPath must reject them. Only the path is scoped; the origin matches here.
+        String issuer = "https://idp.example.com/realms/acme";
+        // a genuine sub-path endpoint stays accepted
+        Assert.assertTrue(invokeIsEndpointUnderIssuerPath("https://idp.example.com/realms/acme/protocol/token", issuer));
+        // split, double, and literal-backslash separators all resolve to a deeper /realms/acme/evil and are rejected
+        Assert.assertFalse(invokeIsEndpointUnderIssuerPath("https://idp.example.com/realms/acme%2%66evil/token", issuer));
+        Assert.assertFalse(invokeIsEndpointUnderIssuerPath("https://idp.example.com/realms/acme%252fevil/token", issuer));
+        Assert.assertFalse(invokeIsEndpointUnderIssuerPath("https://idp.example.com/realms/acme\\evil/token", issuer));
+    }
+
     @Test(timeout = 30_000)
     public void testLargeSplitTokenValueParsesWithConfiguredLexerSizing() throws Exception {
         assertMemoryLeak(() -> {
@@ -2230,9 +2245,10 @@ public void testOutOfRangePollIntervalAndExpiryAreClamped() throws Exception {
                 Assert.assertEquals("ACCESS-CLAMP", auth.getToken());
                 DeviceAuthorizationChallenge challenge = shown.get();
                 Assert.assertNotNull(challenge);
-                // the absurd interval/expires_in are clamped to the documented maxima
-                Assert.assertTrue("interval=" + challenge.getIntervalSeconds(), challenge.getIntervalSeconds() <= 300);
-                Assert.assertTrue("expiresIn=" + challenge.getExpiresInSeconds(), challenge.getExpiresInSeconds() <= 3600);
+                // the absurd interval/expires_in are clamped to the documented maxima: the poll interval to
+                // MAX_POLL_INTERVAL_SECONDS (60) and the device-code lifetime to MAX_DEVICE_CODE_TTL_SECONDS (1800)
+                Assert.assertEquals(60, challenge.getIntervalSeconds());
+                Assert.assertEquals(1800, challenge.getExpiresInSeconds());
             }
         });
     }
@@ -3180,6 +3196,15 @@ private static long readExpiresAtMillis(OidcDeviceAuth auth) throws Exception {
         return f.getLong(auth);
     }
 
+    // isEndpointUnderIssuerPath is a private static security check (it scopes a /settings-advertised endpoint
+    // to the pinned issuer's path); the client is an open module, so reflection reaches it without widening
+    // production visibility for the test
+    private static boolean invokeIsEndpointUnderIssuerPath(String endpointUrl, String issuer) throws Exception {
+        Method m = OidcDeviceAuth.class.getDeclaredMethod("isEndpointUnderIssuerPath", String.class, String.class);
+        m.setAccessible(true);
+        return (boolean) m.invoke(null, endpointUrl, issuer);
+    }
+
     // isLoopbackHost is a private static security classifier (it gates the plaintext-channel MITM pin); the
     // client is an open module, so reflection reaches it without widening production visibility for the test
     private static boolean invokeIsLoopbackHost(String host) throws Exception {