git.iko.soy/typeable/oauth2-proxy
on master help sign in
Issue 1878: Validate URL call does not correctly honor already set UR… (#1951)

* Issue 1878: Validate URL call does not correctly honor already set URL parameters * Issue 1878: Validate URL call does not correctly honor already set URL parameters * Update CHANGELOG.md --------- Co-authored-by: Nuno Borges <Nuno.Borges@ctw.bmwgroup.com> Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

commitcbc973c8d95658468ff569966aec76dc03ede732 authorNuno Miguel Micaelo Borges <miguelborges99@gmail.com> dateFri 10 Feb 2023, 18:36 (4 years ago) parentdf8df9b
3 files changed+23−2
CHANGELOG.md+1−1 providers/internal_util.go+15−1 providers/internal_util_test.go+7
CHANGELOG.md+1−1
@@ -14,9 +14,9 @@
1414- [#1906](https://github.com/oauth2-proxy/oauth2-proxy/pull/1906) Fix PKCE code verifier generation to never use UTF-8 characters
1515- [#1839](https://github.com/oauth2-proxy/oauth2-proxy/pull/1839) Add readiness checks for deeper health checks (@kobim)
1616- [#1927](https://github.com/oauth2-proxy/oauth2-proxy/pull/1927) Fix default scope settings for none oidc providers
17+- [#1951](https://github.com/oauth2-proxy/oauth2-proxy/pull/1951) Fix validate URL, check if query string marker (?) or separator (&) needs to be appended (@miguelborges99)
1718- [#1920](https://github.com/oauth2-proxy/oauth2-proxy/pull/1920) Make sure emailClaim is not overriden if userIDClaim is not set
1819
19−
2020# V7.4.0
2121
2222## Release Highlights
providers/internal_util.go+15−1
@@ -53,7 +53,11 @@ func validateToken(ctx context.Context, p Provider, accessToken string, header h
5353 endpoint := p.Data().ValidateURL.String()
5454 if len(header) == 0 {
5555 params := url.Values{"access_token": {accessToken}}
56− endpoint = endpoint + "?" + params.Encode()
56+ if hasQueryParams(endpoint) {
57+ endpoint = endpoint + "&" + params.Encode()
58+ } else {
59+ endpoint = endpoint + "?" + params.Encode()
60+ }
5761 }
5862
5963 result := requests.New(endpoint).
@@ -74,3 +78,13 @@ func validateToken(ctx context.Context, p Provider, accessToken string, header h
7478 logger.Errorf("token validation request failed: status %d - %s", result.StatusCode(), result.Body())
7579 return false
7680}
81+
82+// hasQueryParams check if URL has query parameters
83+func hasQueryParams(endpoint string) bool {
84+ endpointURL, err := url.Parse(endpoint)
85+ if err != nil {
86+ return false
87+ }
88+
89+ return len(endpointURL.RawQuery) != 0
90+}
providers/internal_util_test.go+7
@@ -132,6 +132,13 @@ func TestValidateSessionExpiredToken(t *testing.T) {
132132 assert.Equal(t, false, validateToken(context.Background(), vtTest.provider, "foobar", nil))
133133}
134134
135+func TestValidateSessionValidateURLWithQueryParams(t *testing.T) {
136+ vtTest := NewValidateSessionTest()
137+ defer vtTest.Close()
138+ vtTest.provider.Data().ValidateURL, _ = url.Parse(vtTest.provider.Data().ValidateURL.String() + "?query_param1=true&query_param2=test")
139+ assert.Equal(t, true, validateToken(context.Background(), vtTest.provider, "foobar", nil))
140+}
141+
135142func TestStripTokenNotPresent(t *testing.T) {
136143 test := "http://local.test/api/test?a=1&b=2"
137144 assert.Equal(t, test, stripToken(test))