oidc_child: Fix logic error and URL-encode short_name in Keycloak lookup

[kkzhsh]

Fixed a copy-paste logic error in the condition check and added URL encoding for the extracted short_name before using it in the Keycloak search query string.

:fixes: Fixed logic error and missing URL encoding in Keycloak group lookup that could produce invalid API requests.

[gemini-code-assist]

Code Review

This pull request fixes a logical condition in keycloak_lookup when parsing group names, ensuring cases where the @ separator is missing or at the start of the input are correctly handled. The reviewer identified a security vulnerability where the extracted short_name is not URL-encoded before being used in the query string, which could lead to parameter injection or invalid URLs, and provided a code suggestion to resolve it.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The extracted short_name is used directly in the Keycloak search filter query string without being URL-encoded. If the group name contains special characters (such as spaces, &, or #), this will result in an invalid URL or potentially parameter injection. We should URL-encode the short_name after duplicating it, similar to how input_enc is handled.

            char *short_name_raw = talloc_strndup(rest_ctx, input, sep - input);
            if (short_name_raw == NULL) {
                short_name = NULL;
            } else {
                short_name = url_encode_string(rest_ctx, short_name_raw);
                talloc_free(short_name_raw);
            }

[sumit-bose]

Hi,

thank you for fixing the logic issues. The comment from Gemini is valid, would you like to add a fix for this as well?

bye,
Sumit

[kkzhsh]

ok. PR has been updated according to Gemini comment.

[sumit-bose]

Hi,

thank you for the fix and the updates, ACK.

The CI failures are not related imo.

bye,
Sumit