Allow an underscore in the mobile app callback url scheme

Mobile apps derive the scheme from their package name, which may contain
an underscore. It cannot introduce an authority, so accepting it keeps
the rule as strong as the RFC 3986 grammar.

application/src/main/java/org/thingsboard/server/service/security/auth/oauth2/CallbackUrlSchemeValidator.java

@@ -26,7 +26,8 @@ import java.util.regex.Pattern;
 @Slf4j
 public class CallbackUrlSchemeValidator {
 
-    private static final Pattern SCHEME_PATTERN = Pattern.compile("[a-zA-Z][a-zA-Z0-9+.-]*");
+    // RFC 3986 scheme grammar, plus '_': mobile apps derive the scheme from their package name, which may contain one
+    private static final Pattern SCHEME_PATTERN = Pattern.compile("[a-zA-Z][a-zA-Z0-9+.\\-_]*");
     private static final Set<String> FORBIDDEN_SCHEMES = Set.of("http", "https", "javascript", "data", "file", "vbscript");
     private static final int MAX_LOGGED_LENGTH = 128;
 

application/src/test/java/org/thingsboard/server/service/security/auth/oauth2/CallbackUrlSchemeValidatorTest.java

@@ -26,7 +26,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 public class CallbackUrlSchemeValidatorTest {
 
     @ParameterizedTest
-    @ValueSource(strings = {"tbmobile", "tb-mobile.app1", "TbMobile+1"})
+    @ValueSource(strings = {"tbmobile", "tb-mobile.app1", "TbMobile+1", "org.mycompany.myapp.auth", "com.my_company.app.auth"})
     public void testMobileAppSchemeIsValid(String callbackUrlScheme) {
         assertThat(CallbackUrlSchemeValidator.isValid(callbackUrlScheme)).isTrue();
     }