Merge pull request bshaffer#695 from bshaffer/Maks3w-hotfix/663

bshaffer · bshaffer · commit f6dcbbafbbf0 · 2016-01-11T13:28:36.000-08:00
Fix for bshaffer#663 and Test case
diff --git a/src/OAuth2/Controller/AuthorizeController.php b/src/OAuth2/Controller/AuthorizeController.php
@@ -341,9 +341,14 @@ protected function validateRedirectUri($inputUri, $registeredUriString)
                     return true;
                 }
             } else {
+                $registered_uri_length = strlen($registered_uri);
+                if ($registered_uri_length === 0) {
+                    return false;
+                }
+
                 // the input uri is validated against the registered uri using case-insensitive match of the initial string
                 // i.e. additional query parameters may be applied
-                if (strcasecmp(substr($inputUri, 0, strlen($registered_uri)), $registered_uri) === 0) {
+                if (strcasecmp(substr($inputUri, 0, $registered_uri_length), $registered_uri) === 0) {
                     return true;
                 }
             }
diff --git a/test/OAuth2/Controller/AuthorizeControllerTest.php b/test/OAuth2/Controller/AuthorizeControllerTest.php
@@ -178,6 +178,22 @@ public function testInvalidRedirectUri()
         $this->assertEquals($response->getParameter('error_description'), 'The redirect URI provided is missing or does not match');
     }
 
+    public function testInvalidRedirectUriApprovedByBuggyRegisteredUri()
+    {
+        $server = $this->getTestServer();
+        $server->setConfig('require_exact_redirect_uri', false);
+        $request = new Request(array(
+            'client_id' => 'Test Client ID with Buggy Redirect Uri', // valid client id
+            'redirect_uri' => 'http://adobe.com', // invalid redirect URI
+            'response_type' => 'code',
+        ));
+        $server->handleAuthorizeRequest($request, $response = new Response(), true);
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'redirect_uri_mismatch');
+        $this->assertEquals($response->getParameter('error_description'), 'The redirect URI provided is missing or does not match');
+    }
+
     public function testNoRedirectUriWithMultipleRedirectUris()
     {
         $server = $this->getTestServer();
diff --git a/test/config/storage.json b/test/config/storage.json
@@ -42,6 +42,10 @@
             "client_secret": "TestSecret2",
             "redirect_uri": "http://brentertainment.com"
         },
+        "Test Client ID with Buggy Redirect Uri": {
+            "client_secret": "TestSecret2",
+            "redirect_uri": "  http://brentertainment.com"
+        },
         "Test Client ID with Multiple Redirect Uris": {
             "client_secret": "TestSecret3",
             "redirect_uri": "http://brentertainment.com http://morehazards.com"

Original file line number	Diff line number	Diff line change
`@@ -341,9 +341,14 @@ protected function validateRedirectUri($inputUri, $registeredUriString)`
`341`	`341`	`return true;`
`342`	`342`	`}`
`343`	`343`	`} else {`
	`344`	`+ $registered_uri_length = strlen($registered_uri);`
	`345`	`+ if ($registered_uri_length === 0) {`
	`346`	`+ return false;`
	`347`	`+ }`
	`348`	`+`
`344`	`349`	`// the input uri is validated against the registered uri using case-insensitive match of the initial string`
`345`	`350`	`// i.e. additional query parameters may be applied`
`346`		`- if (strcasecmp(substr($inputUri, 0, strlen($registered_uri)), $registered_uri) === 0) {`
	`351`	`+ if (strcasecmp(substr($inputUri, 0, $registered_uri_length), $registered_uri) === 0) {`
`347`	`352`	`return true;`
`348`	`353`	`}`
`349`	`354`	`}`