-
Notifications
You must be signed in to change notification settings - Fork 280
Open
Labels
priority: p4type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.Error or flaw in code with unintended results or allowing sub-optimal usage patterns.
Description
google-oauth-java-client's LocalServerReceiver corrupts authorization code if the code contains encoded = sign (%3D).
Environment details
- OS type and version: any
- Java version: 17
- google-oauth-client-jetty-1.36.0.jar
Steps to reproduce
- Run
PKCESample.javaagainst any OAuth server - If the authorization code returned from the server contains %3D, this is removed and POST for token fails. For example, if the OAuth server opened: http://localhost:8089/Callback?code=AgAg...pRfrigVQHIyP4erQ%3D
- When getQuery is called, the
%3Dis decoded to=. - When queryToMap is called, the split("=") is called, and the
=at the end of the code is removed, thus corrupting the authorization code.
Any additional information below
Issue is on google-oauth-java-client's LocalServerReceiver line 282.
getRawQuery() should be used instead. Then decoded after queryToMap call.
Metadata
Metadata
Assignees
Labels
priority: p4type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.Error or flaw in code with unintended results or allowing sub-optimal usage patterns.