avoid memory leak and fix check_oauth2

Signed-off-by: Hans Zandbelt <[email protected]>
OpenIDC · Apr 19, 2023 · 44a3892 · 44a3892
1 parent c6226b5
commit 44a3892
Show file tree

Hide file tree

Showing 2 changed files with 38 additions and 37 deletions.
diff --git a/src/oauth2.c b/src/oauth2.c
@@ -540,21 +540,6 @@ static bool _oauth2_metadata_verify_callback(oauth2_log_t *log,
 	if (oauth2_json_decode_object(log, response, &json_metadata) == false)
 		goto end;
 
-	json_issuer = json_object_get(json_metadata, "issuer");
-	if (json_issuer) {
-		if (json_is_string(json_issuer)) {
-			ptr->jwks_uri_verify->issuer =
-			    oauth2_strdup(json_string_value(json_issuer));
-		} else {
-			oauth2_error(log, "\"issuer\" value is not a string");
-			goto end;
-		}
-	} else {
-		oauth2_error(log,
-			     "required \"issuer\" value not found in metadata");
-		goto end;
-	}
-
 	peek = oauth2_jose_jwt_header_peek(log, token, NULL);
 	if (peek) {
 		oauth2_debug(log, "JWT token: header=%s", peek);
@@ -579,6 +564,24 @@ static bool _oauth2_metadata_verify_callback(oauth2_log_t *log,
 		// config setting
 		jwks_uri_verify =
 		    oauth2_jose_jwt_verify_ctx_clone(log, ptr->jwks_uri_verify);
+
+		json_issuer = json_object_get(json_metadata, "issuer");
+		if (json_issuer) {
+			if (json_is_string(json_issuer)) {
+				jwks_uri_verify->issuer = oauth2_strdup(
+				    json_string_value(json_issuer));
+			} else {
+				oauth2_error(
+				    log, "\"issuer\" value is not a string");
+				goto end;
+			}
+		} else {
+			oauth2_error(
+			    log,
+			    "required \"issuer\" value not found in metadata");
+			goto end;
+		}
+
 		oauth2_cfg_endpoint_set_url(
 		    jwks_uri_verify->jwks_provider->jwks_uri->endpoint,
 		    jwks_uri);

diff --git a/test/check_oauth2.c b/test/check_oauth2.c
@@ -1145,29 +1145,27 @@ Suite *oauth2_check_oauth2_suite()
 						oauth2_check_oauth2_serve_post);
 
 	tcase_add_checked_fixture(c, setup, teardown);
-	/*
-		tcase_add_test(c, test_oauth2_auth_client_secret_basic);
-		tcase_add_test(c, test_oauth2_auth_client_secret_post);
-		tcase_add_test(c, test_oauth2_auth_client_secret_jwt);
-		tcase_add_test(c, test_oauth2_auth_private_key_jwt);
-		tcase_add_test(c, test_oauth2_auth_client_cert);
-		tcase_add_test(c, test_oauth2_auth_http_basic);
-		tcase_add_test(c, test_oauth2_auth_none);
-		tcase_add_test(c, test_oauth2_verify_clone);
-		tcase_add_test(c, test_oauth2_verify_jwks_uri);
-		tcase_add_test(c, test_oauth2_verify_jwk);
-		tcase_add_test(c, test_oauth2_verify_jwk_dpop);
-		tcase_add_test(c, test_oauth2_verify_eckey_uri);
-		tcase_add_test(c, test_oauth2_verify_token_introspection);
-		tcase_add_test(c, test_oauth2_verify_token_plain);
-		tcase_add_test(c, test_oauth2_verify_token_base64);
-		tcase_add_test(c, test_oauth2_verify_token_base64url);
-		tcase_add_test(c, test_oauth2_verify_token_hex);
-		tcase_add_test(c, test_oauth2_verify_token_pem);
-		tcase_add_test(c, test_oauth2_verify_token_pubkey);
-	*/
+	tcase_add_test(c, test_oauth2_auth_client_secret_basic);
+	tcase_add_test(c, test_oauth2_auth_client_secret_post);
+	tcase_add_test(c, test_oauth2_auth_client_secret_jwt);
+	tcase_add_test(c, test_oauth2_auth_private_key_jwt);
+	tcase_add_test(c, test_oauth2_auth_client_cert);
+	tcase_add_test(c, test_oauth2_auth_http_basic);
+	tcase_add_test(c, test_oauth2_auth_none);
+	tcase_add_test(c, test_oauth2_verify_clone);
+	tcase_add_test(c, test_oauth2_verify_jwks_uri);
+	tcase_add_test(c, test_oauth2_verify_jwk);
+	tcase_add_test(c, test_oauth2_verify_jwk_dpop);
+	tcase_add_test(c, test_oauth2_verify_eckey_uri);
+	tcase_add_test(c, test_oauth2_verify_token_introspection);
+	tcase_add_test(c, test_oauth2_verify_token_plain);
+	tcase_add_test(c, test_oauth2_verify_token_base64);
+	tcase_add_test(c, test_oauth2_verify_token_base64url);
+	tcase_add_test(c, test_oauth2_verify_token_hex);
+	tcase_add_test(c, test_oauth2_verify_token_pem);
+	tcase_add_test(c, test_oauth2_verify_token_pubkey);
 	tcase_add_test(c, test_oauth2_verify_token_metadata);
-	//	tcase_add_test(c, test_oauth2_verify_jwk_mtls);
+	tcase_add_test(c, test_oauth2_verify_jwk_mtls);
 
 	suite_add_tcase(s, c);