Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish gh-15533

This commit is contained in:
Steve Riesenberg 2024-09-19 15:50:43 -05:00
parent 8a791028b1
commit 7b7a3044cf
No known key found for this signature in database
GPG Key ID: 3D0169B18AB8F0A9
2 changed files with 63 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/endpoint/OAuth2AuthorizationRequest.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2020 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -23,13 +23,11 @@ import java.util.Arrays;
import java.util.Collections;
import java.util.LinkedHashMap;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.function.Consumer;
import java.util.function.Function;
import java.util.stream.Stream;
import java.util.stream.StreamSupport;
import org.springframework.security.core.SpringSecurityCoreVersion;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.util.Assert;
@ -465,12 +463,20 @@ public final class OAuth2AuthorizationRequest implements Serializable {
Map<String, Object> parameters = getParameters(); // Not encoded
this.parametersConsumer.accept(parameters);
MultiValueMap<String, String> queryParams = new LinkedMultiValueMap<>();
parameters.forEach((key1, value) -> {
String key = encodeQueryParam(key1);
List<String> values = queryValues(value)
.map(o -> encodeQueryParam(String.valueOf(o)))
.toList();
queryParams.put(key, values);
parameters.forEach((k, v) -> {
String key = encodeQueryParam(k);
if (v instanceof Iterable) {
((Iterable<?>) v).forEach((value) -> queryParams.add(key, encodeQueryParam(String.valueOf(value))));
}
else if (v != null && v.getClass().isArray()) {
Object[] values = (Object[]) v;
for (Object value : values) {
queryParams.add(key, encodeQueryParam(String.valueOf(value)));
}
}
else {
queryParams.set(key, encodeQueryParam(String.valueOf(v)));
}
});
UriBuilder uriBuilder = this.uriBuilderFactory.uriString(this.authorizationUri).queryParams(queryParams);
return this.authorizationRequestUriFunction.apply(uriBuilder).toString();
@ -498,20 +504,6 @@ public final class OAuth2AuthorizationRequest implements Serializable {
return UriUtils.encodeQueryParam(value, StandardCharsets.UTF_8);
}
// Query value as a stream
// If the value is an Iterable or an array it will be converted to a stream
private static Stream<?> queryValues(Object value) {
if (value instanceof Iterable) {
return StreamSupport.stream(((Iterable<?>) value).spliterator(), false);
} else if (value.getClass().isArray()) {
return Arrays.stream((Object[]) value);
} else {
return Stream.of(value);
}
}
}
}

61
oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/endpoint/OAuth2AuthorizationRequestTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2020 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -16,18 +16,21 @@
package org.springframework.security.oauth2.core.endpoint;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
import java.net.URI;
import java.util.Arrays;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.LinkedHashSet;
import java.util.Map;
import java.util.Set;
import org.junit.jupiter.api.Test;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
/**
* Tests for {@link OAuth2AuthorizationRequest}.
*
@ -363,18 +366,48 @@ public class OAuth2AuthorizationRequestTests {
}
@Test
public void additionalParametersArrayValueOrIterableEncoded() {
Map<String, Object> additionalParameters = new HashMap<>();
additionalParameters.put("item", new String[] { "1", "2" });
additionalParameters.put("item2", Arrays.asList("H" + '\u00c5' + "M" + '\u00d6', "H" + '\u00c5' + "M" + '\u00d6'));
public void buildWhenAdditionalParametersContainsArrayThenProperlyEncoded() {
Map<String, Object> additionalParameters = new LinkedHashMap<>();
additionalParameters.put("item1", new String[] { "1", "2" });
additionalParameters.put("item2", "value2");
OAuth2AuthorizationRequest authorizationRequest = TestOAuth2AuthorizationRequests.request()
.additionalParameters(additionalParameters)
.build();
.additionalParameters(additionalParameters)
.build();
assertThat(authorizationRequest.getAuthorizationRequestUri()).isNotNull();
assertThat(authorizationRequest.getAuthorizationRequestUri()).isEqualTo(
"https://example.com/login/oauth/authorize?" + "response_type=code&client_id=client-id&state=state&"
+ "redirect_uri=https://example.com/authorize/oauth2/code/registration-id&"
+ "item=1&item=2&item2=H%C3%85M%C3%96&item2=H%C3%85M%C3%96");
assertThat(authorizationRequest.getAuthorizationRequestUri())
.isEqualTo("https://example.com/login/oauth/authorize?response_type=code&client_id=client-id&state=state&"
+ "redirect_uri=https://example.com/authorize/oauth2/code/registration-id&"
+ "item1=1&item1=2&item2=value2");
}
@Test
public void buildWhenAdditionalParametersContainsIterableThenProperlyEncoded() {
Map<String, Object> additionalParameters = new LinkedHashMap<>();
additionalParameters.put("item1", Arrays.asList("1", "2"));
additionalParameters.put("item2", "value2");
OAuth2AuthorizationRequest authorizationRequest = TestOAuth2AuthorizationRequests.request()
.additionalParameters(additionalParameters)
.build();
assertThat(authorizationRequest.getAuthorizationRequestUri()).isNotNull();
assertThat(authorizationRequest.getAuthorizationRequestUri())
.isEqualTo("https://example.com/login/oauth/authorize?response_type=code&client_id=client-id&state=state&"
+ "redirect_uri=https://example.com/authorize/oauth2/code/registration-id&"
+ "item1=1&item1=2&item2=value2");
}
@Test
public void buildWhenAdditionalParametersContainsNullThenAuthorizationRequestUriContainsNull() {
Map<String, Object> additionalParameters = new LinkedHashMap<>();
additionalParameters.put("item1", null);
additionalParameters.put("item2", "value2");
OAuth2AuthorizationRequest authorizationRequest = TestOAuth2AuthorizationRequests.request()
.additionalParameters(additionalParameters)
.build();
assertThat(authorizationRequest.getAuthorizationRequestUri()).isNotNull();
assertThat(authorizationRequest.getAuthorizationRequestUri())
.isEqualTo("https://example.com/login/oauth/authorize?response_type=code&client_id=client-id&state=state&"
+ "redirect_uri=https://example.com/authorize/oauth2/code/registration-id&"
+ "item1=null&item2=value2");
}
}