kotovalexarian-likes-github/omniauth--omniauth
1
0
Fork 0
mirror of https://github.com/omniauth/omniauth.git synced 2022-11-09 12:31:49 -05:00
Code Releases Activity

security issue in returning post parameters from session in callback phase

Browse source
This commit is contained in:
Lalith Rallabhandi 2017-01-10 23:04:18 -05:00
parent 640e5d9cd5
commit 71866c5264
No known key found for this signature in database
GPG key ID: 9BB1952C52E099C1
2 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/omniauth/strategy.rb
View file

@ -198,7 +198,7 @@ module OmniAuth
setup_phase
log :info, 'Request phase initiated.'
# store query params from the request url, extracted in the callback_phase
session['omniauth.params'] = request.params
session['omniauth.params'] = request.GET
OmniAuth.config.before_request_phase.call(env) if OmniAuth.config.before_request_phase
if options.form.respond_to?(:call)
log :info, 'Rendering form from supplied Rack endpoint.'
@ -265,7 +265,7 @@ module OmniAuth
def mock_request_call
setup_phase
session['omniauth.params'] = request.params
session['omniauth.params'] = request.GET
OmniAuth.config.before_request_phase.call(env) if OmniAuth.config.before_request_phase
if request.params['origin']
@env['rack.session']['omniauth.origin'] = request.params['origin']

13
spec/omniauth/strategy_spec.rb
View file

@ -685,13 +685,24 @@ describe OmniAuth::Strategy do
expect(strategy.env['foobar']).to eq('baz')
end
it 'sets omniauth.params on the request phase' do
it 'sets omniauth.params with query params on the request phase' do
OmniAuth.config.mock_auth[:test] = {}
strategy.call(make_env('/auth/test', 'QUERY_STRING' => 'foo=bar'))
expect(strategy.env['rack.session']['omniauth.params']).to eq('foo' => 'bar')
end
it 'does not set body parameters of POST request on the request phase' do
OmniAuth.config.mock_auth[:test] = {}
props = {
'REQUEST_METHOD' => 'POST',
'rack.input' => StringIO.new('foo=bar')
}
strategy.call(make_env('/auth/test', props))
expect(strategy.env['rack.session']['omniauth.params']).to eq({})
end
it 'executes request hook on the request phase' do
OmniAuth.config.mock_auth[:test] = {}
OmniAuth.config.before_request_phase do |env|