toby3d/auth
toby3d
/
auth
1
0
Fork 0
Code Actions Packages Releases Activity

🐛 Don't modify redirect_uri from request by pointer

This commit is contained in:
Maxim Lebedev 2023-12-06 00:23:40 +06:00
parent 59a6250e2b
commit 4232743b00
Signed by: toby3d
GPG Key ID: 1F14E25B7C119FC5
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
internal/auth/delivery/http/auth_http.go
View File

@ -3,6 +3,7 @@ package http
import (
"crypto/subtle"
"net/http"
"net/url"
"strings"
"github.com/goccy/go-json"
@ -219,7 +220,8 @@ func (h *Handler) handleVerify(w http.ResponseWriter, r *http.Request) {
return
}
q := req.RedirectURI.Query()
redirect, _ := url.Parse(req.RedirectURI.String())
q := redirect.Query()
for key, val := range map[string]string{
"code": code,
@ -229,9 +231,9 @@ func (h *Handler) handleVerify(w http.ResponseWriter, r *http.Request) {
q.Set(key, val)
}
req.RedirectURI.RawQuery = q.Encode()
redirect.RawQuery = q.Encode()
http.Redirect(w, r, req.RedirectURI.String(), http.StatusFound)
http.Redirect(w, r, redirect.String(), http.StatusFound)
}
func (h *Handler) handleExchange(w http.ResponseWriter, r *http.Request) {