Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: invalid numerics notation in session data #3722

Closed
wants to merge 4 commits into from
Closed

fix: invalid numerics notation in session data #3722

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d6e4b57
Fix invalid numerics exponential notation
nekiro Feb 23, 2024
02bfaa4
Add helper to avoid repeated code in handlers
nekiro May 7, 2024
f992e81
Merge branch 'master' into fix/invalid-numerics-notation
nekiro May 7, 2024
fa2ed97
Ensure proper number format in AcceptOAuth2ConsentRequestSession
nekiro Jun 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 12 additions & 13 deletions consent/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
package consent

import (
"encoding/json"
"net/http"
"net/url"
"time"
Expand Down Expand Up @@ -432,9 +431,9 @@ func (h *Handler) acceptOAuth2LoginRequest(w http.ResponseWriter, r *http.Reques
}

var handledLoginRequest flow.HandledLoginRequest
d := json.NewDecoder(r.Body)
d.DisallowUnknownFields()
if err := d.Decode(&handledLoginRequest); err != nil {

err := decodeRequestBody(r, &handledLoginRequest)
if err != nil {
h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrInvalidRequest.WithWrap(err).WithHintf("Unable to decode body because: %s", err)))
return
}
Expand Down Expand Up @@ -560,9 +559,9 @@ func (h *Handler) rejectOAuth2LoginRequest(w http.ResponseWriter, r *http.Reques
}

var p flow.RequestDeniedError
d := json.NewDecoder(r.Body)
d.DisallowUnknownFields()
if err := d.Decode(&p); err != nil {

err := decodeRequestBody(r, &p)
if err != nil {
h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrInvalidRequest.WithWrap(err).WithHintf("Unable to decode body because: %s", err)))
return
}
Expand Down Expand Up @@ -744,9 +743,9 @@ func (h *Handler) acceptOAuth2ConsentRequest(w http.ResponseWriter, r *http.Requ
}

var p flow.AcceptOAuth2ConsentRequest
d := json.NewDecoder(r.Body)
d.DisallowUnknownFields()
if err := d.Decode(&p); err != nil {

err := decodeRequestBody(r, &p)
if err != nil {
h.r.Writer().WriteErrorCode(w, r, http.StatusBadRequest, errorsx.WithStack(err))
return
}
Expand Down Expand Up @@ -853,9 +852,9 @@ func (h *Handler) rejectOAuth2ConsentRequest(w http.ResponseWriter, r *http.Requ
}

var p flow.RequestDeniedError
d := json.NewDecoder(r.Body)
d.DisallowUnknownFields()
if err := d.Decode(&p); err != nil {

err := decodeRequestBody(r, &p)
if err != nil {
h.r.Writer().WriteErrorCode(w, r, http.StatusBadRequest, errorsx.WithStack(err))
return
}
Expand Down
10 changes: 10 additions & 0 deletions consent/helper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@
package consent

import (
"encoding/json"
"net/http"

"github.com/ory/fosite"
"github.com/ory/hydra/v2/client"
"github.com/ory/hydra/v2/flow"
Expand Down Expand Up @@ -38,3 +41,10 @@ func matchScopes(scopeStrategy fosite.ScopeStrategy, previousConsent []flow.Acce

return nil
}

func decodeRequestBody(r *http.Request, v interface{}) error {
decoder := json.NewDecoder(r.Body)
decoder.DisallowUnknownFields()
decoder.UseNumber()
return decoder.Decode(v)
}
16 changes: 16 additions & 0 deletions flow/consent_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,9 @@
"database/sql/driver"
"encoding/json"
"fmt"
"math"
"net/http"
"strconv"
"time"

"github.com/gobuffalo/pop/v6"
Expand Down Expand Up @@ -742,8 +744,22 @@
func (r *AcceptOAuth2ConsentRequestSession) MarshalJSON() ([]byte, error) {
type Alias AcceptOAuth2ConsentRequestSession
alias := Alias(*r)

if alias.AccessToken == nil {
alias.AccessToken = map[string]interface{}{}
} else {
// ensure numbers are properly converted to their respective types instead of forcing float64
for key, value := range alias.AccessToken {
switch v := value.(type) {

Check failure on line 753 in flow/consent_types.go

View workflow job for this annotation

GitHub Actions / Run tests and lints 

File is not `goimports`-ed (goimports)
case float64:
_, frac := math.Modf(v)
if frac == 0.0 {
alias.AccessToken[key] = json.Number(strconv.FormatInt(int64(v), 10))
} else {
alias.AccessToken[key] = json.Number(strconv.FormatFloat(v, 'f', -1, 64))
}
}
}
}

if alias.IDToken == nil {
Expand Down
Loading