-
-
Notifications
You must be signed in to change notification settings - Fork 50
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(handler): deny access when body.allowed is 'false' #94
Conversation
Hi, the pr seems a sure improvement. Btw, I also checked the Regards. |
The usage of strings is actually correct since all parameters are passed as a string, both in the query as in the body. |
@HappyZombies @jwerre can you please second-check and merge if everything is okay? |
@HappyZombies @jwerre please one of you need to 2nd check, since it would make no sense if I review my own PR ;-) If you also see no issues you can merge immediately |
@Uzlopak would you mind taking a look at this? |
lib/handlers/authorize-handler.js
Outdated
request.body.allowed | ||
].some(allowed => 'false' === allowed); | ||
|
||
if (notAllowed) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nah. It should be something like
if (request.query.allowed === 'false' || request.body.allowed === 'false')
Also why is there no check for request.body.allowed === false? Does formData not allow boolean values?
Also: is it safe? Doesn't OAUth2 server add the allowed url fragment when the authorization finished. So actually you would get a redirect which is a Get and not a post. Not that we accidently make it possible to bypass something? Seems unlikely.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Okay then I would update it towards this:
const notAllowed = ['false', false].some(value => request.query.allowed === value || request.body.allowed === value)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
FormData does indeed not allow booleans. They only allow strings and blobs.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why do you like some()
? Also query can not be a boolean value, as query has by definition only string values.
if (
request.query.allowed === 'false' ||
request.body.allowed === 'false' ||
request.body.allowed === false
)
Is much easier to read and probably the most performant too.
Just wanted to also suggest, that we should actually check for the opposite. Like query.allowed !== 'true'. From security point of view an explicit allowed is better.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@jorenvandeweyer
UrlEncoded FormData, Thanks for looking up.
So it should be simply:
if (
request.query.allowed === 'false' ||
request.body.allowed === 'false'
)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok, will do
Updated and merged development, please review again |
Summary
Implements missing access check when body.allowed is 'false'
Linked issue(s)
oauthjs/node-oauth2-server#532
#89
Involved parts of the project
AuthorizeHandler
Added tests?
Integration tests added
OAuth2 standard
https://datatracker.ietf.org/doc/html/rfc6749.html#section-4.1.1
Reproduction
Clone, checkout branch, test