spring-projects / spring-projects/spring-security
Consider Checking RFC 6749 Constraints in OAuth2Error
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
BearerTokenError validates its constructor parameters against the character set specified by RFC 6750. For example:
Assert.isTrue(isScopeValid(scope),
"scope contains invalid ASCII characters, it must conform to RFC 6750");
This is becauseBearerTokenError is a class that intentionally represents OAuth 2.0 bearer token errors from RFC 6750.
We ought to consider having OAuth2Error validate its constructor parameters against the character set specified by RFC 6749.
OAuth2Error appears to be a class that intentionally represents OAuth 2.0 errors from RFC 6749.
Not verifying that errorCode, description, and errorUri meet this criteria may be a bug. Reports in other libraries demonstrate where allowing invalid characters can cause problems.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate OAuth2Error in the Spring Security source and inspect how its errorCode, description, and errorUri constructor parameters are handled. Compare that behavior with the character-set constraints in RFC 6749 section 5.2 and verify that the issue is resolved when those parameters conform to the specified constraints.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100