Only accept a selected IdP if its ID is known

app.py

@@ -206,18 +206,19 @@ def get_index():
     if request.method == "POST":
         try:
             chosen_idp_entity_id = request.form["idp_entity_id"]
-            query[return_param] = chosen_idp_entity_id
-            return_url = urllib.parse.urlunparse(
-                (
-                    parse_result.scheme,
-                    parse_result.netloc,
-                    parse_result.path,
-                    parse_result.params,
-                    urllib.parse.urlencode(query),
-                    parse_result.fragment,
+            if any((idp.entity_id == chosen_idp_entity_id for idp in available_idps)):
+                query[return_param] = chosen_idp_entity_id
+                return_url = urllib.parse.urlunparse(
+                    (
+                        parse_result.scheme,
+                        parse_result.netloc,
+                        parse_result.path,
+                        parse_result.params,
+                        urllib.parse.urlencode(query),
+                        parse_result.fragment,
+                    )
                 )
-            )
-            return redirect(return_url)
+                return redirect(return_url)
         except KeyError:
             # if the submission is invalid, show the form again
             pass