fix: invalid numerics notation in session data #3722
Conversation
|
|
nekiro
changed the title
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #3722 +/- ##
==========================================
- Coverage 76.39% 76.23% -0.17%
==========================================
Files 135 134 -1
Lines 10283 10211 -72
==========================================
- Hits 7856 7784 -72
- Misses 1907 1910 +3
+ Partials 520 517 -3 ☔ View full report in Codecov by Sentry. |
consent/handler.go
Outdated
| @@ -745,6 +745,7 @@ func (h *Handler) acceptOAuth2ConsentRequest(w http.ResponseWriter, r *http.Requ | |||
|
|
|||
| var p flow.AcceptOAuth2ConsentRequest | |||
| d := json.NewDecoder(r.Body) | |||
| d.UseNumber() | |||
There was a problem hiding this comment.
This will only fix it for this specific endpoint. Another way of solving this is to override MarshalJSON of flow.AcceptOAuth2ConsentRequest and similar methods.
There was a problem hiding this comment.
I don't think other "endpoints" have problems, this issue is specifically with the data saved into session. I didn't notice other places where this would be an issue.
There was a problem hiding this comment.
Hey, I added small helper and replaced occurrences of decode in several handlers. I'm not sure how can I use MarshalJSON methods with this change as there is only call to json.Marshal there.
I'm also not really a go developer, so I'm not used to work with this language.
|
The issue seems to be deeper, in fosite to be exact. |
This PR fixes invalid numerics notation in stored session data.
Checklist
introduces a new feature.
contributing code guidelines.
vulnerability. If this pull request addresses a security vulnerability, I
confirm that I got the approval (please contact
[email protected]) from the maintainers to push
the changes.
works.
Further Comments
Hydra (as of not sure which version, it worked fine on 1.8.5 though) incorrectly converts big (larger than 999999) numeric values into exponential notation.
This breaks the compatibility with older hydra versions and is in fact incorrect.
Playground to test this change:
https://go.dev/play/p/NDYofwinU4M
Reference:
https://groups.google.com/g/golang-nuts/c/Fd5jUfHxbh8