Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Properly encode / sanitize URL's (Example: authorization_endpoint) #11472

Closed
2 tasks done
michaelstingl opened this issue Jan 15, 2024 · 3 comments · Fixed by #11479
Closed
2 tasks done

Properly encode / sanitize URL's (Example: authorization_endpoint) #11472

michaelstingl opened this issue Jan 15, 2024 · 3 comments · Fixed by #11479
Assignees
Labels
p2-high Escalation, on top of current planning, release blocker type:bug
Milestone

Comments

@michaelstingl
Copy link
Contributor

Pre-submission Checks

  • I checked for similar issues, but could not find any. I also checked the closed issues. I could not contribute additional information to any existing issue.
  • I will take the time to fill in all the required fields. I know that the bug report may be dismissed otherwise due to lack of information.

Describe the bug

ownCloud Desktop sync client generates invalid URL's with Space characters:

https://keycloak.ocis-keycloak.latest.owncloud.works/realms/oCIS/protocol/openid-connect/auth?response_type=code
&client_id=c604798c-7977-46a5-8beb-e3df13e65413
&redirect_uri=http://127.0.0.1:54213
&code_challenge=5G3yQGITsH_CPkQDIXL7irH5rEN_BydI3s0YOCr7fHs
&code_challenge_method=S256
&scope=openid offline_access email profile
&prompt=select_account consent
&state=G_jOhNJru34iqmG1ULYA04Gd7GYY7ubu22z-gkmPyzg%3D

Expected behavior

URL's should be properly encoded / sanitized.

Steps to reproduce the issue

No response

Screenshots

CleanShot 2024-01-15 at 16 06 07

Logs

No response

Client version number

ownCloud 6.0.0.13116-daily20240115 [0d34c9](https://github.com/owncloud/client/commit/0d34c9844f69cba89b687ee093b2838bf1114647)
Libraries Qt 6.6.0, OpenSSL 3.1.4 24 Oct 2023
Using virtual files plugin: suffix
OS: macos-23.2.0 (build arch: arm64, CPU arch: arm64)
QPA: cocoa

Desktop environment (Linux only)

No response

Client package version and origin (Linux only)

No response

Installation path (Windows only)

No response

Server information

https://ocis.ocis-keycloak.latest.owncloud.works/

[Log]  ownCloud Web UI 8.0.0-rc.1  (index.html-MZztZoFM.mjs, line 1)
[Log]  Infinite Scale 5.1.0-prealpha+21e4b7d29 Community  (index.html-MZztZoFM.mjs, line 1)

Additional context

Doesn't work in curl:

curl "https://keycloak.ocis-keycloak.latest.owncloud.works/realms/oCIS/protocol/openid-connect/auth?response_type=code&client_id=c604798c-7977-46a5-8beb-e3df13e65413&redirect_uri=http://127.0.0.1:54213&code_challenge=5G3yQGITsH_CPkQDIXL7irH5rEN_BydI3s0YOCr7fHs&code_challenge_method=S256&scope=openid offline_access email profile&prompt=select_account consent&state=G_jOhNJru34iqmG1ULYA04Gd7GYY7ubu22z-gkmPyzg%3D" 
curl: (3) URL rejected: Malformed input to a URL function
curl --version
curl 8.4.0 (x86_64-apple-darwin23.0) libcurl/8.4.0 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.55.1
Release-Date: 2023-10-11
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM NTLM_WB SPNEGO SSL threadsafe UnixSockets
@michaelstingl michaelstingl added the p2-high Escalation, on top of current planning, release blocker label Jan 15, 2024
@michaelstingl
Copy link
Contributor Author

Isn't there some Qt magic we can use?

@michaelstingl michaelstingl added this to the Desktop 6.0 milestone Jan 15, 2024
@TheOneRing
Copy link
Contributor

Isn't there some Qt magic we can use?

Encoding a url is no magic.

erikjv added a commit that referenced this issue Jan 17, 2024
The scope and the prompt items of an OAuth query can be branded and can
contain characters that are not valid without encoding them. This change
makes sure that those get encoded properly.

Fixes: #11472
erikjv added a commit that referenced this issue Jan 18, 2024
The scope and the prompt items of an OAuth query can be branded and can
contain characters that are not valid without encoding them. This change
makes sure that those get encoded properly.

Fixes: #11472
erikjv added a commit that referenced this issue Jan 31, 2024
The scope and the prompt items of an OAuth query can be branded and can
contain characters that are not valid without encoding them. This change
makes sure that those get encoded properly.

Fixes: #11472
erikjv added a commit that referenced this issue Jan 31, 2024
The scope and the prompt items of an OAuth query can be branded and can
contain characters that are not valid without encoding them. This change
makes sure that those get encoded properly.

Fixes: #11472
@saw-jan
Copy link
Member

saw-jan commented Feb 2, 2024

Tested with ownCloud 6.0.0.13239-daily20240202 [149151]

encoded URL: white spaces are encoded

https://ocis.owncloud.com/signin/v1/identifier/_/authorize?
response_type=code&
client_id=xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69&
redirect_uri=http://127.0.0.1:42941&
code_challenge=s7-HFF9KTtGKzd1jZ1Y_Zz8uaIc3IZ7gbljHZKKN9bo&
code_challenge_method=S256&
scope=openid%20offline_access%20email%20profile&
prompt=select_account%20consent&
state=hLuInZ2ZLIOWNVAiJ1yyIR3UBkyymJg87ob_YbnVUsY%3D

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
p2-high Escalation, on top of current planning, release blocker type:bug
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants