IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

OAuth: Fix parsing of ID token if header contains non-string value (#44159)

Browse Source 
Fixes #41111
This commit is contained in:
Marcus Efraimsson 2022-01-25 17:09:35 +01:00 committed by GitHub
parent 3c1122cf29
commit 9ab9fd802b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/login/social/generic_oauth.go
View File

@ -231,13 +231,19 @@ func (s *SocialGenericOAuth) extractFromToken(token *oauth2.Token) *UserInfoJson
return nil return nil
} }
var header map[string]string var header map[string]interface{}
if err := json.Unmarshal(headerBytes, &header); err != nil { if err := json.Unmarshal(headerBytes, &header); err != nil {
s.log.Error("Error deserializing header", "error", err) s.log.Error("Error deserializing header", "error", err)
return nil return nil
} }
if compression, ok := header["zip"]; ok { if compressionVal, exists := header["zip"]; exists {
compression, ok := compressionVal.(string)
if !ok {
s.log.Warn("Unknown compression algorithm")
return nil
}
if compression != "DEF" { if compression != "DEF" {
s.log.Warn("Unknown compression algorithm", "algorithm", compression) s.log.Warn("Unknown compression algorithm", "algorithm", compression)
return nil return nil

8
pkg/login/social/generic_oauth_test.go
View File

@ -727,6 +727,14 @@ func TestPayloadCompression(t *testing.T) {
}, },
ExpectedEmail: "john.doe@example.com", ExpectedEmail: "john.doe@example.com",
}, },
{
Name: "Given a valid DEFLATE compressed id_token with numeric header, return userInfo",
OAuth2Extra: map[string]interface{}{
// Generated from https://token.dev/
"id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsInZlciI6NH0.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTY0MjUxNjYwNSwiZXhwIjoxNjQyNTIwMjA1LCJlbWFpbCI6ImpvaG4uZG9lQGV4YW1wbGUuY29tIn0.ANndoPWIHNjKPG8na7UUq7nan1RgF8-ze8STU31RXcA",
},
ExpectedEmail: "john.doe@example.com",
},
{ {
Name: "Given an invalid DEFLATE compressed id_token, return nil", Name: "Given an invalid DEFLATE compressed id_token, return nil",
OAuth2Extra: map[string]interface{}{ OAuth2Extra: map[string]interface{}{