From 9ab9fd802b8fb4874e735e5f474b2c1809c81c5c Mon Sep 17 00:00:00 2001 From: Marcus Efraimsson Date: Tue, 25 Jan 2022 17:09:35 +0100 Subject: [PATCH] OAuth: Fix parsing of ID token if header contains non-string value (#44159) Fixes #41111 --- pkg/login/social/generic_oauth.go | 10 ++++++++-- pkg/login/social/generic_oauth_test.go | 8 ++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/pkg/login/social/generic_oauth.go b/pkg/login/social/generic_oauth.go index e20cee43fb4..2ad76148885 100644 --- a/pkg/login/social/generic_oauth.go +++ b/pkg/login/social/generic_oauth.go @@ -231,13 +231,19 @@ func (s *SocialGenericOAuth) extractFromToken(token *oauth2.Token) *UserInfoJson return nil } - var header map[string]string + var header map[string]interface{} if err := json.Unmarshal(headerBytes, &header); err != nil { s.log.Error("Error deserializing header", "error", err) return nil } - if compression, ok := header["zip"]; ok { + if compressionVal, exists := header["zip"]; exists { + compression, ok := compressionVal.(string) + if !ok { + s.log.Warn("Unknown compression algorithm") + return nil + } + if compression != "DEF" { s.log.Warn("Unknown compression algorithm", "algorithm", compression) return nil diff --git a/pkg/login/social/generic_oauth_test.go b/pkg/login/social/generic_oauth_test.go index b72172ab88b..9be66f1e3ac 100644 --- a/pkg/login/social/generic_oauth_test.go +++ b/pkg/login/social/generic_oauth_test.go @@ -727,6 +727,14 @@ func TestPayloadCompression(t *testing.T) { }, ExpectedEmail: "john.doe@example.com", }, + { + Name: "Given a valid DEFLATE compressed id_token with numeric header, return userInfo", + OAuth2Extra: map[string]interface{}{ + // Generated from https://token.dev/ + "id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsInZlciI6NH0.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTY0MjUxNjYwNSwiZXhwIjoxNjQyNTIwMjA1LCJlbWFpbCI6ImpvaG4uZG9lQGV4YW1wbGUuY29tIn0.ANndoPWIHNjKPG8na7UUq7nan1RgF8-ze8STU31RXcA", + }, + ExpectedEmail: "john.doe@example.com", + }, { Name: "Given an invalid DEFLATE compressed id_token, return nil", OAuth2Extra: map[string]interface{}{