cloudfoundry / cloudfoundry/uaa
Revoke access does not work with a client id containing !
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.6k
- Forks
- 844
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 27
Description
SECURITY NOTICE: If you have found a security problem in the UAA, please do not file a public github issue. Instead, please send an email to security@cloudfoundry.org
Thanks for taking the time to file an issue. You'll minimize back and forth and help us help you more effectively by answering all of the following questions as specifically and completely as you can.
What version of UAA are you running?
4.24
What output do you see from curl <YOUR_UAA>/info -H'Accept: application/json'
(hostnames removed)
{
"app": {
"version": "4.24.0"
},
"links": {
"uaa": "https://uaa.##",
"passwd": "https://account##/#/home/welcome",
"login": "https://login.##",
"register": "https://account##/#/home/welcome"
},
"zone_name": "uaa",
"entityID": "login.##",
"commit_id": "16d9900",
"idpDefinitions": {},
"prompts": {
"username": [
"text",
"User ID"
],
"password": [
"password",
"Password"
]
},
"timestamp": "2018-11-06T01:20:26+0000"
}
How are you deploying the UAA?
bosh as part of cf deployment
I am deploying the UAA
- using cf-deployment
What did you do?
Register a OAuth client containing a !, e.g. my-app!s22.
After using the authorization code flow without auto-approve, the application appear on user account (home screen->upper right navigation menu) for revocation. Revocation works for clients without a ! in the id, but fails for clients with a ! in the client id.
Browser console reports the following error:
Uncaught Error: Syntax error, unrecognized expression: #sb-faas-live!s1934-scrim
at Function.fa.error (jquery.js:2)
at fa.tokenize (jquery.js:2)
at fa.select (jquery.js:2)
at Function.fa [as find] (jquery.js:2)
at n.fn.init.find (jquery.js:2)
at new n.fn.init (jquery.js:2)
at n (jquery.js:2)
at HTMLAnchorElement. (profile:26)
at HTMLAnchorElement.dispatch (jquery.js:3)
at HTMLAnchorElement.r.handle (jquery.js:3)
fa.error @ jquery.js:2
fa.tokenize @ jquery.js:2
fa.select @ jquery.js:2
fa @ jquery.js:2
find @ jquery.js:2
n.fn.init @ jquery.js:2
n @ jquery.js:2
(anonymous) @ profile:26
dispatch @ jquery.js:3
r.handle @ jquery.js:3
What did you expect to see? What goal are you trying to achieve with the UAA?
Confimation dialog if the application should be revoked.
What did you see instead?
Error in the browser console
Please include UAA logs if available.
Client side issue.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce revocation from the UAA profile page with an OAuth client ID containing !, such as my-app!s22, and inspect the client-side handler associated with the reported jQuery selector error. Done means the confirmation dialog opens and revocation works for client IDs containing !, without the browser console error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, jquery
- Domain
- authentication, frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100