-
-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: invalid numerics notation in session data #3722
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #3722 +/- ##
==========================================
- Coverage 76.39% 76.23% -0.17%
==========================================
Files 135 134 -1
Lines 10283 10211 -72
==========================================
- Hits 7856 7784 -72
- Misses 1907 1910 +3
+ Partials 520 517 -3 ☔ View full report in Codecov by Sentry. |
consent/handler.go
Outdated
@@ -745,6 +745,7 @@ func (h *Handler) acceptOAuth2ConsentRequest(w http.ResponseWriter, r *http.Requ | |||
|
|||
var p flow.AcceptOAuth2ConsentRequest | |||
d := json.NewDecoder(r.Body) | |||
d.UseNumber() |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This will only fix it for this specific endpoint. Another way of solving this is to override MarshalJSON
of flow.AcceptOAuth2ConsentRequest
and similar methods.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think other "endpoints" have problems, this issue is specifically with the data saved into session. I didn't notice other places where this would be an issue.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hey, I added small helper and replaced occurrences of decode in several handlers. I'm not sure how can I use MarshalJSON methods with this change as there is only call to json.Marshal there.
I'm also not really a go developer, so I'm not used to work with this language.
The issue seems to be deeper, in fosite to be exact. |
This PR fixes invalid numerics notation in stored session data.
Checklist
introduces a new feature.
contributing code guidelines.
vulnerability. If this pull request addresses a security vulnerability, I
confirm that I got the approval (please contact
[email protected]) from the maintainers to push
the changes.
works.
Further Comments
Hydra (as of not sure which version, it worked fine on 1.8.5 though) incorrectly converts big (larger than 999999) numeric values into exponential notation.
This breaks the compatibility with older hydra versions and is in fact incorrect.
Playground to test this change:
https://go.dev/play/p/NDYofwinU4M
Reference:
https://groups.google.com/g/golang-nuts/c/Fd5jUfHxbh8