Special characters not accepting in relationship tuple while writing

[Akash-Adkute]

Hi,
I am beginner in openFga, i wanted to store URL as object in relationship tuples but it is not allowing special characters and
giving invalid 'object' field format
eg.

{
  "writes": {
    "tuple_keys": [
      {
        "user": "users:UUID",
        "relation": "have_user_endpoint_mapping",
        **"object": "endpoint:https://amazon.com/loc/mum"**
      }
    ]
  },
  "authorization_model_id": "ID"
}

[rhamzeh]

👋🏽 Hey @Akash-Adkute

At the moment, :, # and @ are not allowed characters in ids. In your case, the URL contains a : in the https:. While we would like to change it so that those two characters are accepted, it would require some breaking changes so I would not expect that it would happen any time soon.

In the meantime you can escape those characters before calling OpenFGA

Will update you if we end up doing that though!

[Mario-Eis]

Can you please explain, why the @ sign is not supported? It seems to work fine. There is no validation error when using it.

[Mario-Eis]

Also, did you miss * in your list? We found out, that a * in an ID triggers a validation exception.
But we are pertty much out of ideas on what we are allowed to pass and what not.

[aaguiarz]

@Akash-Adkute I converted this to an "Idea" as it's something we should explore how to do in the product in a better way.

[Mario-Eis]

I think this issue is not only inconvenient, but also a major security risk.
So in my opinion, this should get adressed with much more priority.
And meanwhile it should, at least, be documented somewhere. e.g. also see openfga/openfga.dev#883

String concatenation to a :-notation leaves the door wide open for string injection. And there is absolutely no documentation regarding how to handle real world data that is not a hard coded example string that just always works. It least nothing I could find. And i tried pretty hard, because right now we are in a situation where this issue could become a potential problem for our project.

...At the moment, :, # and @ are not allowed characters in ids....
...In the meantime you can escape those characters before calling OpenFGA...

This is also the first place I could read something official about that. Both workarounds have major downsides. Escaping means a dirty data set that probably can not be repaired easily in the future. And also leaving the CLI tool useless from now on. Because (I would think) it does not support escape routines?
And the second workaround, invalidating characters at the input level, will now be a major "thats not what we ordered" from our customers side.