toby3d/auth
toby3d
/
auth
1
0
Fork 0
Code Actions Packages Releases Activity

🐛 Fixed profile injection panic in /userinfo route

This commit is contained in:
Maxim Lebedev 2022-02-18 00:22:20 +05:00
parent 1480f58cac
commit 460bd1a657
Signed by: toby3d
GPG Key ID: 1F14E25B7C119FC5
1 changed files with 23 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
internal/user/delivery/http/user_http.go
View File

@ -16,10 +16,10 @@ import (
type (
UserInformationResponse struct {
Name string `json:"name,omitempty"`
URL *domain.URL `json:"url,omitempty"`
Photo *domain.URL `json:"photo,omitempty"`
Email *domain.Email `json:"email,omitempty"`
Name string `json:"name,omitempty"`
URL string `json:"url,omitempty"`
Photo string `json:"photo,omitempty"`
Email string `json:"email,omitempty"`
}
RequestHandler struct {
@ -75,21 +75,32 @@ func (h *RequestHandler) handleUserInformation(ctx *http.RequestCtx) {
return
}
if !tkn.Scope.Has(domain.ScopeProfile) && !tkn.Scope.Has(domain.ScopeEmail) {
if !tkn.Scope.Has(domain.ScopeProfile) {
ctx.SetStatusCode(http.StatusForbidden)
_ = encoder.Encode(domain.NewError(
domain.ErrorCodeInsufficientScope,
"token with 'profile' and/or 'email' scopes is required to view profile data",
"token with 'profile' scope is required to view profile data",
"https://indieauth.net/source/#user-information",
))
return
}
_ = encoder.Encode(&UserInformationResponse{
Name: "",
URL: &domain.URL{},
Photo: &domain.URL{},
Email: &domain.Email{},
})
resp := new(UserInformationResponse)
if tkn.Extra == nil {
_ = encoder.Encode(resp)
return
}
resp.Name, _ = tkn.Extra["name"].(string)
resp.URL, _ = tkn.Extra["url"].(string)
resp.Photo, _ = tkn.Extra["photo"].(string)
if tkn.Scope.Has(domain.ScopeEmail) {
resp.Email, _ = tkn.Extra["email"].(string)
}
_ = encoder.Encode(resp)
}