techies/authelia
1
0
Fork 0
mirror of https://github.com/0rangebananaspy/authelia.git synced 2024-09-14 22:47:21 +07:00
Code Issues Projects Releases Wiki Activity

fix(model): potential panic (#3538)

Browse Source 
This fixes a potential panic in the conversion from a fosite.Requester to an *OAuth2Session object.
This commit is contained in:
James Elliott 2022-06-17 22:25:14 +10:00 committed by GitHub
parent 25b5c1ee2e
commit d9c7cd6564
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
internal/handlers/handler_oidc_token.go
View File

@ -44,6 +44,8 @@ func OpenIDConnectTokenPOST(ctx *middlewares.AutheliaCtx, rw http.ResponseWriter
}
}
ctx.Logger.Tracef("Access Request with id '%s' on client with id '%s' response is being generated for session with type '%T'", requester.GetID(), client.GetID(), requester.GetSession())
if responder, err = ctx.Providers.OpenIDConnect.Fosite.NewAccessResponse(ctx, requester); err != nil {
rfc := fosite.ErrorToRFC6749Error(err)

23
internal/model/oidc.go
View File

@ -4,7 +4,6 @@ import (
"context"
"crypto/sha256"
"encoding/json"
"errors"
"fmt"
"net/url"
"time"
@ -40,23 +39,27 @@ func NewOAuth2ConsentSession(subject NullUUID, r fosite.Requester) (consent *OAu
func NewOAuth2SessionFromRequest(signature string, r fosite.Requester) (session *OAuth2Session, err error) {
var (
subject string
openidSession *OpenIDSession
sessData []byte
sessionOpenID *OpenIDSession
sessionData []byte
)
openidSession = r.GetSession().(*OpenIDSession)
if openidSession == nil {
return nil, errors.New("unexpected session type")
s := r.GetSession()
switch t := s.(type) {
case *OpenIDSession:
sessionOpenID = t
default:
return nil, fmt.Errorf("can't convert type '%T' to an *OAuth2Session", s)
}
subject = openidSession.GetSubject()
subject = sessionOpenID.GetSubject()
if sessData, err = json.Marshal(openidSession); err != nil {
if sessionData, err = json.Marshal(sessionOpenID); err != nil {
return nil, err
}
return &OAuth2Session{
ChallengeID: openidSession.ChallengeID,
ChallengeID: sessionOpenID.ChallengeID,
RequestID: r.GetID(),
ClientID: r.GetClient().GetID(),
Signature: signature,
@ -69,7 +72,7 @@ func NewOAuth2SessionFromRequest(signature string, r fosite.Requester) (session
Active: true,
Revoked: false,
Form: r.GetRequestForm().Encode(),
Session: sessData,
Session: sessionData,
}, nil
}