api: add explicit lookup_value_regex, disable include_format_suffixes

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

authentik/api/v3/urls.py

@@ -99,6 +99,7 @@ from authentik.stages.user_write.api import UserWriteStageViewSet
 from authentik.tenants.api import TenantViewSet
 
 router = routers.DefaultRouter()
+router.include_format_suffixes = False
 
 router.register("admin/system_tasks", TaskViewSet, basename="admin_system_tasks")
 router.register("admin/apps", AppsViewSet, basename="apps")

authentik/core/api/applications.py

@@ -77,6 +77,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
         "meta_publisher",
     ]
     lookup_field = "slug"
+    lookup_value_regex = r"^[-a-zA-Z0-9_]+\Z"
     ordering = ["name"]
 
     def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:

authentik/core/api/sources.py

@@ -62,6 +62,7 @@ class SourceViewSet(
     queryset = Source.objects.none()
     serializer_class = SourceSerializer
     lookup_field = "slug"
+    lookup_value_regex = r"^[-a-zA-Z0-9_]+\Z"
 
     def get_queryset(self):  # pragma: no cover
         return Source.objects.select_subclasses()

authentik/core/api/tokens.py

@@ -66,6 +66,7 @@ class TokenViewSerializer(PassiveSerializer):
 class TokenViewSet(UsedByMixin, ModelViewSet):
     """Token Viewset"""
 
+    lookup_value_regex = r"^[-a-zA-Z0-9_]+\Z"
     lookup_field = "identifier"
     queryset = Token.objects.all()
     serializer_class = TokenSerializer

authentik/flows/api/flows.py

@@ -108,6 +108,7 @@ class FlowViewSet(UsedByMixin, ModelViewSet):
     queryset = Flow.objects.all()
     serializer_class = FlowSerializer
     lookup_field = "slug"
+    lookup_value_regex = r"^[-a-zA-Z0-9_]+\Z"
     search_fields = ["name", "slug", "designation", "title"]
     filterset_fields = ["flow_uuid", "name", "slug", "designation"]
 

authentik/sources/ldap/api.py

@@ -69,6 +69,7 @@ class LDAPSourceViewSet(UsedByMixin, ModelViewSet):
     queryset = LDAPSource.objects.all()
     serializer_class = LDAPSourceSerializer
     lookup_field = "slug"
+    lookup_value_regex = r"^[-a-zA-Z0-9_]+\Z"
     filterset_fields = [
         "name",
         "slug",

authentik/sources/oauth/api/source.py

@@ -84,6 +84,7 @@ class OAuthSourceViewSet(UsedByMixin, ModelViewSet):
     queryset = OAuthSource.objects.all()
     serializer_class = OAuthSourceSerializer
     lookup_field = "slug"
+    lookup_value_regex = r"^[-a-zA-Z0-9_]+\Z"
     filterset_fields = [
         "name",
         "slug",

authentik/sources/plex/api/source.py

@@ -49,6 +49,7 @@ class PlexSourceViewSet(UsedByMixin, ModelViewSet):
     queryset = PlexSource.objects.all()
     serializer_class = PlexSourceSerializer
     lookup_field = "slug"
+    lookup_value_regex = r"^[-a-zA-Z0-9_]+\Z"
     filterset_fields = [
         "name",
         "slug",

authentik/sources/saml/api.py

@@ -40,6 +40,7 @@ class SAMLSourceViewSet(UsedByMixin, ModelViewSet):
     queryset = SAMLSource.objects.all()
     serializer_class = SAMLSourceSerializer
     lookup_field = "slug"
+    lookup_value_regex = r"^[-a-zA-Z0-9_]+\Z"
     filterset_fields = "__all__"
     ordering = ["name"]