Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

original port should not be ignored (fusionauth-issues/issues/2250) #9

Merged

Conversation

MarekUniq
Copy link
Contributor

Summary

original port should not be ignored (FusionAuth/fusionauth-issues#2250)

Steps to reproduce

Start docker image with port mapping 2222:9011

--- docker-compose.yml ---
services:
fusionauth:
image: fusionauth/fusionauth-app:1.45.2
ports:
- 2222:9011
--- docker-compose.yml ---

Configure "Google Identity Provider" (possibly any other provider)

Goto URL http://loalhost:2222/admin

Click on "Google Identity Provider" button to log in

Login fails because of wrong redirect_uri:
redirect_uri=http://localhost:9011/oauth2/callback

Expected redirect_uri:

redirect_uri=http://localhost:2222/oauth2/callback

Change in PR

Change is tested with version 1.45.2 by replacing just one java class (HTTPRequest) in docker image using the following technique:

Dockerfile

FROM fusionauth/fusionauth-app:1.45.2
USER root
RUN apt update && apt install unzip zip
USER fusionauth
WORKDIR /usr/local/fusionauth/fusionauth-app/lib
COPY --chown=fusionauth ./build/ ./build/
RUN unzip ./java-http-0.1.13.jar -d unzipped
RUN cp ./build/classes/io/fusionauth/http/server/HTTPRequest.class ./unzipped/io/fusionauth/http/server/HTTPRequest.class
RUN (cd ./unzipped ; zip -u ../java-http-0.1.13.jar)
RUN rm -rf ./build ./unzipped

@robotdan
Copy link
Member

@voidmain thoughts on this one?

@@ -738,6 +738,9 @@ private void decodeHeader(String name, String value) {
int colon = value.indexOf(':');
if (colon > 0) {
this.host = value.substring(0, colon);
String portString = value.substring(colon + 1);
if (portString.trim().length() > 0)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this necessary? I don't think you can have spaces around port numbers per spec.

Also, we use the java coding standards so this needs curly braces for the if-statement.

Finally, this could fail really hard if the parseInt fails. This should protect against bad values and fall back to the server port.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • trim() removed
  • curly braces for the if-statement added
  • NumberFormatException handling added to parseInt
    • negative test cases added to test NumberFormatException handling

@voidmain
Copy link
Member

Left some comments. This looks good in principle. It just needs some cleanup and some defensive coding.

@MarekUniq MarekUniq requested a review from voidmain June 1, 2023 14:26
Copy link
Member

@voidmain voidmain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@voidmain voidmain merged commit 45a20e4 into FusionAuth:master Jun 4, 2023
@MarekUniq MarekUniq deleted the bugfix/requestedurl_port_is_ignored branch June 6, 2023 12:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants