-
Notifications
You must be signed in to change notification settings - Fork 3.7k
Description
Description
When configuring OAuth credentials (e.g. GitHub Client ID) through the God Mode admin UI, any leading/trailing whitespace in the pasted value is persisted to the database as-is. This causes the OAuth redirect URL to include a URL-encoded space (%20) in the client_id parameter, which makes the identity provider return a 404.
This is easy to trigger — simply copy-pasting a Client ID from a web page often picks up a trailing space.
Steps to reproduce
- Self-host Plane v1.2.3 (also present on
previewbranch) - Go to God Mode → Authentication → GitHub → Configure
- Paste a GitHub OAuth Client ID with a trailing space (e.g.
Ov23li2Dep2t79q18nxD) - Save and enable GitHub SSO
- Click "Login with GitHub" on the login page
- The redirect URL contains
client_id=Ov23li2Dep2t79q18nxD%20 - GitHub returns a 404
Expected behavior
Configuration values should be stripped of leading/trailing whitespace before being persisted to the database.
Actual behavior
Whitespace is saved verbatim, breaking OAuth flows and potentially any other credential that is sensitive to extra characters.
Root cause
InstanceConfigurationEndpoint.patch() in apps/api/plane/license/api/views/configuration.py saves the raw value from request.data without calling .strip():
value = request.data.get(configuration.key, configuration.value)Affected
All OAuth providers (GitHub, Google, GitLab, Gitea) and likely any credential field saved via the instance configuration endpoint.
Environment
- Plane version: v1.2.3 (also present on current
previewbranch) - Deployment: Self-hosted Docker Compose