Spring/spring-authorization-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch '1.1.x'

Browse Source 
Closes gh-1318
This commit is contained in:
Steve Riesenberg
2023-07-27 14:04:44 -05:00
parent 509b332c2d 215c101c3d
commit 357e200924
5 changed files with 35 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceAuthorizationConsentAuthenticationConverter.java
View File

@@ -80,7 +80,7 @@ public final class OAuth2DeviceAuthorizationConsentAuthenticationConverter imple
// user_code (REQUIRED)
String userCode = parameters.getFirst(OAuth2ParameterNames.USER_CODE);
if (!StringUtils.hasText(userCode) ||
if (!OAuth2EndpointUtils.validateUserCode(userCode) ||
parameters.get(OAuth2ParameterNames.USER_CODE).size() != 1) {
OAuth2EndpointUtils.throwError(
OAuth2ErrorCodes.INVALID_REQUEST,

3
oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceVerificationAuthenticationConverter.java
View File

@@ -30,7 +30,6 @@ import org.springframework.security.oauth2.server.authorization.authentication.O
import org.springframework.security.oauth2.server.authorization.web.OAuth2DeviceVerificationEndpointFilter;
import org.springframework.security.web.authentication.AuthenticationConverter;
import org.springframework.util.MultiValueMap;
import org.springframework.util.StringUtils;
/**
* Attempts to extract a user code from {@link HttpServletRequest} for the
@@ -64,7 +63,7 @@ public final class OAuth2DeviceVerificationAuthenticationConverter implements Au
// user_code (REQUIRED)
String userCode = parameters.getFirst(OAuth2ParameterNames.USER_CODE);
if (!StringUtils.hasText(userCode) ||
if (!OAuth2EndpointUtils.validateUserCode(userCode) ||
parameters.get(OAuth2ParameterNames.USER_CODE).size() != 1) {
OAuth2EndpointUtils.throwError(
OAuth2ErrorCodes.INVALID_REQUEST,

3
oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2EndpointUtils.java
View File

@@ -95,4 +95,7 @@ final class OAuth2EndpointUtils {
return sb.toString();
}
static boolean validateUserCode(String userCode) {
return (userCode != null && userCode.toUpperCase().replaceAll("[^A-Z\\d]+", "").length() == 8);
}
}

16
oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceAuthorizationConsentAuthenticationConverterTests.java
View File

@@ -147,6 +147,22 @@ public class OAuth2DeviceAuthorizationConsentAuthenticationConverterTests {
// @formatter:on
}
@Test
public void convertWhenInvalidUserCodeThenInvalidRequestError() {
MockHttpServletRequest request = createRequest();
request.addParameter(OAuth2ParameterNames.STATE, STATE);
request.addParameter(OAuth2ParameterNames.CLIENT_ID, CLIENT_ID);
request.addParameter(OAuth2ParameterNames.USER_CODE, "LONG-USER-CODE");
// @formatter:off
assertThatExceptionOfType(OAuth2AuthenticationException.class)
.isThrownBy(() -> this.converter.convert(request))
.withMessageContaining(OAuth2ParameterNames.USER_CODE)
.extracting(OAuth2AuthenticationException::getError)
.extracting(OAuth2Error::getErrorCode)
.isEqualTo(OAuth2ErrorCodes.INVALID_REQUEST);
// @formatter:on
}
@Test
public void convertWhenMultipleUserCodeParametersThenInvalidRequestError() {
MockHttpServletRequest request = createRequest();

14
oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceVerificationAuthenticationConverterTests.java
View File

@@ -94,6 +94,20 @@ public class OAuth2DeviceVerificationAuthenticationConverterTests {
// @formatter:on
}
@Test
public void convertWhenInvalidUserCodeParameterThenInvalidRequestError() {
MockHttpServletRequest request = createRequest();
request.addParameter(OAuth2ParameterNames.USER_CODE, "LONG-USER-CODE");
// @formatter:off
assertThatExceptionOfType(OAuth2AuthenticationException.class)
.isThrownBy(() -> this.converter.convert(request))
.withMessageContaining(OAuth2ParameterNames.USER_CODE)
.extracting(OAuth2AuthenticationException::getError)
.extracting(OAuth2Error::getErrorCode)
.isEqualTo(OAuth2ErrorCodes.INVALID_REQUEST);
// @formatter:on
}
@Test
public void convertWhenMultipleUserCodeParameterThenInvalidRequestError() {
MockHttpServletRequest request = createRequest();