Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-85928

Best Effort OAuth1 token parsing

    XMLWordPrintable

    Details

    • Type: Suggestion
    • Status: Reported
    • Priority: Not Evaluated
    • Resolution: Unresolved
    • Affects Version/s: 5.15.0
    • Fix Version/s: None
    • Labels:
      None
    • Platform/s:
      All

      Description

      The Oauth1 standard requires the server to respond with Content-Type: application/x-www-form-urlencoded  However the code in qoauthoobreplyhandler.cpp:

       

      void QOAuthOobReplyHandler::networkReplyFinished

      Handles a number of other Content-Types, such as text/html, application/javascript, text/json, etc.

       

      SUGGESTION:

      Instead of issuing a warning and returning when the content type is unknown, attempt to parse the data and only return if the parsing failed:

       

       

      diff --git a/src/oauth/qoauthoobreplyhandler.cpp b/src/oauth/qoauthoobreplyhandler.cpp
      index 0409274..a2c03cd 100644
      --- a/src/oauth/qoauthoobreplyhandler.cpp
      +++ b/src/oauth/qoauthoobreplyhandler.cpp
      @@ -92,7 +92,9 @@ void QOAuthOobReplyHandler::networkReplyFinished(QNetworkReply *reply)
      {{ ret = object.toVariantMap();}}
      {{ } else {}}
      {{ qCWarning(lcReplyHandler, "Unknown Content-type: %s", qPrintable(contentType));}}
      - return;
      + ret = parseResponse(data);
      + if(ret.isEmpty())
      + return;
      {{ }}}

      {{ Q_EMIT tokensReceived(ret);}}

       

      This was discovered while attempting to authenticate against OpenStreetMap.org's auth server.  It returns "text/plain" and the url encoded oauth credentials resulting in failed authentication by QOAuth1.  The content type was ultimately set by the Ruby oauth-plugin project which is used by OSM.

        Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

            Assignee:
            jefernan Jesus Fernandez
            Reporter:
            mbarclay Matt Barclay
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:

                Gerrit Reviews

                There are no open Gerrit changes