cloudfoundry / cloudfoundry/uaa

Revoke access does not work with a client id containing !

Open
#926 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

unscheduled waiting-4-pr
Dominant language
Java
Stars
1.6k
Forks
844
Avg merge
2d 5h
Merged PRs (30d)
27

Description

SECURITY NOTICE: If you have found a security problem in the UAA, please do not file a public github issue. Instead, please send an email to security@cloudfoundry.org

Thanks for taking the time to file an issue. You'll minimize back and forth and help us help you more effectively by answering all of the following questions as specifically and completely as you can.

What version of UAA are you running?

4.24
What output do you see from curl <YOUR_UAA>/info -H'Accept: application/json'
(hostnames removed)
{
"app": {
"version": "4.24.0"
},
"links": {
"uaa": "https://uaa.##",
"passwd": "https://account##/#/home/welcome",
"login": "https://login.##",
"register": "https://account##/#/home/welcome"
},
"zone_name": "uaa",
"entityID": "login.##",
"commit_id": "16d9900",
"idpDefinitions": {},
"prompts": {
"username": [
"text",
"User ID"
],
"password": [
"password",
"Password"
]
},
"timestamp": "2018-11-06T01:20:26+0000"
}

How are you deploying the UAA?

bosh as part of cf deployment

I am deploying the UAA

  • using cf-deployment
What did you do?

Register a OAuth client containing a !, e.g. my-app!s22.

After using the authorization code flow without auto-approve, the application appear on user account (home screen->upper right navigation menu) for revocation. Revocation works for clients without a ! in the id, but fails for clients with a ! in the client id.
Browser console reports the following error:
Uncaught Error: Syntax error, unrecognized expression: #sb-faas-live!s1934-scrim
at Function.fa.error (jquery.js:2)
at fa.tokenize (jquery.js:2)
at fa.select (jquery.js:2)
at Function.fa [as find] (jquery.js:2)
at n.fn.init.find (jquery.js:2)
at new n.fn.init (jquery.js:2)
at n (jquery.js:2)
at HTMLAnchorElement. (profile:26)
at HTMLAnchorElement.dispatch (jquery.js:3)
at HTMLAnchorElement.r.handle (jquery.js:3)
fa.error @ jquery.js:2
fa.tokenize @ jquery.js:2
fa.select @ jquery.js:2
fa @ jquery.js:2
find @ jquery.js:2
n.fn.init @ jquery.js:2
n @ jquery.js:2
(anonymous) @ profile:26
dispatch @ jquery.js:3
r.handle @ jquery.js:3

What did you expect to see? What goal are you trying to achieve with the UAA?

Confimation dialog if the application should be revoked.

What did you see instead?

Error in the browser console
Please include UAA logs if available.
Client side issue.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce revocation from the UAA profile page with an OAuth client ID containing !, such as my-app!s22, and inspect the client-side handler associated with the reported jQuery selector error. Done means the confirmation dialog opens and revocation works for client IDs containing !, without the browser console error.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, jquery
Domain
authentication, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.