go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-05-31 23:19:50 +02:00
Code Issues Releases Activity

Issue 1878: Validate URL call does not correctly honor already set UR… (#1951)

Browse Source 
* Issue 1878: Validate URL call does not correctly honor already set URL parameters

* Issue 1878: Validate URL call does not correctly honor already set URL parameters

* Update CHANGELOG.md

---------

Co-authored-by: Nuno Borges <Nuno.Borges@ctw.bmwgroup.com>
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
This commit is contained in:
Nuno Miguel Micaelo Borges 2023-02-10 18:36:13 +00:00 committed by GitHub
parent df8df9b536
commit cbc973c8d9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGELOG.md
View File

@ -14,9 +14,9 @@
- [#1906](https://github.com/oauth2-proxy/oauth2-proxy/pull/1906) Fix PKCE code verifier generation to never use UTF-8 characters
- [#1839](https://github.com/oauth2-proxy/oauth2-proxy/pull/1839) Add readiness checks for deeper health checks (@kobim)
- [#1927](https://github.com/oauth2-proxy/oauth2-proxy/pull/1927) Fix default scope settings for none oidc providers
- [#1951](https://github.com/oauth2-proxy/oauth2-proxy/pull/1951) Fix validate URL, check if query string marker (?) or separator (&) needs to be appended (@miguelborges99)
- [#1920](https://github.com/oauth2-proxy/oauth2-proxy/pull/1920) Make sure emailClaim is not overriden if userIDClaim is not set
# V7.4.0
## Release Highlights

16
providers/internal_util.go
View File

@ -53,7 +53,11 @@ func validateToken(ctx context.Context, p Provider, accessToken string, header h
endpoint := p.Data().ValidateURL.String()
if len(header) == 0 {
params := url.Values{"access_token": {accessToken}}
endpoint = endpoint + "?" + params.Encode()
if hasQueryParams(endpoint) {
endpoint = endpoint + "&" + params.Encode()
} else {
endpoint = endpoint + "?" + params.Encode()
}
}
result := requests.New(endpoint).
@ -74,3 +78,13 @@ func validateToken(ctx context.Context, p Provider, accessToken string, header h
logger.Errorf("token validation request failed: status %d - %s", result.StatusCode(), result.Body())
return false
}
// hasQueryParams check if URL has query parameters
func hasQueryParams(endpoint string) bool {
endpointURL, err := url.Parse(endpoint)
if err != nil {
return false
}
return len(endpointURL.RawQuery) != 0
}

7
providers/internal_util_test.go
View File

@ -132,6 +132,13 @@ func TestValidateSessionExpiredToken(t *testing.T) {
assert.Equal(t, false, validateToken(context.Background(), vtTest.provider, "foobar", nil))
}
func TestValidateSessionValidateURLWithQueryParams(t *testing.T) {
vtTest := NewValidateSessionTest()
defer vtTest.Close()
vtTest.provider.Data().ValidateURL, _ = url.Parse(vtTest.provider.Data().ValidateURL.String() + "?query_param1=true&query_param2=test")
assert.Equal(t, true, validateToken(context.Background(), vtTest.provider, "foobar", nil))
}
func TestStripTokenNotPresent(t *testing.T) {
test := "http://local.test/api/test?a=1&b=2"
assert.Equal(t, test, stripToken(test))