Contrib.social

Form validation secret

Open on Drupal.org →
Created on 7 February 2023, over 1 year ago
Updated 29 March 2024, 3 months ago

Problem/Motivation

Not sure if it a bug or task, but if you create a secret that has an ampersand the value does not get to the server correctly, this validation should leave us with a secret that can be passed as query argument/form data.

Steps to reproduce

Create secret with ampersand, use this request:

POST {{url}}/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=password&client_id={{ clientId }}&client_secret={{ clientSecret }}&scope=&username={{ userName }}&password={{ userPassword }}

Proposed resolution

Use machine name validation so that special chars are not allowed.

Remaining tasks

Implement

📌 Task
Status

Active

Version

5.2

Component

Code

Created by

🇧🇪Belgium borisson_ Mechelen, 🇧🇪

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @borisson_
  • Status changed to RTBC 5 months ago
  • Comment 5 months ago →
    🇺🇦Ukraine sickness29

    Hi @borisson_
    the field secret actually is not related to the module consumer even though it's on consumer entity.
    The field is added by https://www.drupal.org/project/simple_oauth → to consumer entity, so if there's need for it's validation I believe you need to create this issue for simple_oauth module.

    Hi maintainers,
    please correct me if I'm wrong or mark the issue "Closed (works as designed)", thanks

  • Comment 4 months ago →
    🇺🇸United States eojthebrave Minneapolis, MN

    The 'secret' field is added, and managed, by the simple oauth module. So I'm going to move this issue to that queue where it's more likely to get fixed. Setting the version to 5.2.x-dev as that's the current supported branch. But @borrison_ perhaps you could chime in and let us know what version of the Simple Oauth module you're using when you encounter this.

  • Status changed to Active 4 months ago
  • Comment 4 months ago →
    🇧🇪Belgium borisson_ Mechelen, 🇧🇪

    Not sure what the version was originally, now that project is on 5.2.3.

  • Status changed to RTBC 4 months ago
  • Comment 4 months ago →
    🇺🇦Ukraine sickness29

    Not reproducible on 5.2.x-dev.
    Tried to add '&' symbol to \Drupal\Tests\simple_oauth\Functional\TokenBearerFunctionalTestBase where clientSecret is randomly generated and it does not make any more tests fail.

  • Status changed to Active 3 months ago
  • Comment 3 months ago →
    🇧🇪Belgium BramDriesen Belgium 🇧🇪

    Setting back to active, as there is nothing "reviewed & tested" here.

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024