scope: resolve haystack needle mixup - closes #201

ory · Jul 9, 2017 · 2c7cdff · 2c7cdff
1 parent c55d679
commit 2c7cdff
Show file tree

Hide file tree

Showing 6 changed files with 73 additions and 47 deletions.
diff --git a/handler/oauth2/flow_authorize_code_auth_test.go b/handler/oauth2/flow_authorize_code_auth_test.go
@@ -5,12 +5,13 @@ import (
 	"strings"
 	"testing"
 
+	"time"
+
 	"github.com/ory/fosite"
 	"github.com/ory/fosite/storage"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"time"
 )
 
 func parseUrl(uu string) *url.URL {
@@ -72,7 +73,7 @@ func TestAuthorizeCode_HandleAuthorizeEndpointRequest(t *testing.T) {
 								RedirectURIs:  []string{"https://asdf.de/cb"},
 							},
 							GrantedScopes: fosite.Arguments{"a", "b"},
-							Session:       &fosite.DefaultSession{
+							Session: &fosite.DefaultSession{
 								ExpiresAt: map[fosite.TokenType]time.Time{fosite.AccessToken: time.Now().Add(time.Hour)},
 							},
 							RequestedAt: time.Now(),

diff --git a/handler/oauth2/flow_authorize_code_token_test.go b/handler/oauth2/flow_authorize_code_token_test.go
@@ -81,7 +81,7 @@ func TestAuthorizeCode_PopulateTokenEndpointResponse(t *testing.T) {
 					setup: func(t *testing.T, areq *fosite.AccessRequest) {
 						require.NoError(t, store.CreateAuthorizeCodeSession(nil, "bar", areq))
 					},
-					expectErr:   fosite.ErrInvalidRequest,
+					expectErr: fosite.ErrInvalidRequest,
 				},
 				{
 					areq: &fosite.AccessRequest{

diff --git a/scope_strategy.go b/scope_strategy.go
@@ -35,23 +35,29 @@ func HierarchicScopeStrategy(haystack []string, needle string) bool {
 	return false
 }
 
-func WildcardScopeStrategy(haystack []string, needle string) bool {
-	for _, this := range haystack {
-		if this == needle {
-			return true
-		}
+func WildcardScopeStrategy(matchers []string, needle string) bool {
+	needleParts := strings.Split(needle, ".")
+	for _, matcher := range matchers {
+		matcherParts := strings.Split(matcher, ".")
 
-		needles := strings.Split(needle, ".")
-		haystack := strings.Split(this, ".")
-		if len(needles) != len(haystack) {
+		if len(matcherParts) > len(needleParts) {
 			continue
 		}
 
 		var noteq bool
-		for k, needle := range needles {
-			current := haystack[k]
-			if needle == "*" && len(current) > 0 {
-			} else if current != needle {
+		for k, c := range strings.Split(matcher, ".") {
+			// this is the last item and the lengths are different
+			if k == len(matcherParts)-1 && len(matcherParts) != len(needleParts) {
+				if c != "*" {
+					noteq = true
+					break
+				}
+			}
+
+			if c == "*" && len(needleParts[k]) > 0 {
+				// pass because this satisfies the requirements
+				continue
+			} else if c != needleParts[k] {
 				noteq = true
 				break
 			}

diff --git a/scope_strategy_test.go b/scope_strategy_test.go
@@ -47,43 +47,61 @@ func TestWildcardScopeStrategy(t *testing.T) {
 	var scopes = []string{}
 
 	assert.False(t, strategy(scopes, "foo.bar.baz"))
-	assert.False(t, strategy(scopes, "foo.*.bar"))
-	assert.False(t, strategy(scopes, "foo.*"))
-	assert.False(t, strategy(scopes, "*"))
+	assert.False(t, strategy(scopes, "foo.bar"))
 
-	scopes = []string{""}
-	assert.False(t, strategy(scopes, "*"))
+	scopes = []string{"*"}
+	assert.False(t, strategy(scopes, ""))
+	assert.True(t, strategy(scopes, "asdf"))
+	assert.True(t, strategy(scopes, "asdf.asdf"))
 
 	scopes = []string{"foo"}
-	assert.True(t, strategy(scopes, "*"))
+	assert.False(t, strategy(scopes, "*"))
 	assert.False(t, strategy(scopes, "foo.*"))
 	assert.False(t, strategy(scopes, "fo*"))
+	assert.True(t, strategy(scopes, "foo"))
 
-	scopes = []string{"foo.bar"}
-	assert.True(t, strategy(scopes, "foo.*"))
-
-	scopes = []string{"foo.baz"}
-	assert.True(t, strategy(scopes, "foo.*"))
-	assert.False(t, strategy(scopes, "foo.*.foo"))
-	assert.False(t, strategy(scopes, "foo.*."))
-	assert.False(t, strategy(scopes, "foo.foo.*."))
-	assert.False(t, strategy(scopes, "foo.foo.*"))
-
-	scopes = []string{"foo.baz.bar"}
-	assert.False(t, strategy(scopes, "foo.*"))
-	assert.True(t, strategy(scopes, "foo.*.*"))
-	assert.True(t, strategy(scopes, "foo.*.bar"))
-	assert.True(t, strategy(scopes, "foo.baz.*"))
-	assert.True(t, strategy(scopes, "foo.baz.bar"))
-	assert.False(t, strategy(scopes, "foo.b*.bar"))
+	scopes = []string{"foo*"}
+	assert.False(t, strategy(scopes, "foo"))
+	assert.False(t, strategy(scopes, "fooa"))
+	assert.False(t, strategy(scopes, "fo"))
+	assert.True(t, strategy(scopes, "foo*"))
 
-	scopes = []string{"foo.bar", "foo.baz.bar"}
-	assert.True(t, strategy(scopes, "foo.*"))
-	assert.True(t, strategy(scopes, "foo.*.*"))
-	assert.True(t, strategy(scopes, "foo.*.bar"))
-	assert.False(t, strategy(scopes, "foo.bar.*"))
-	assert.True(t, strategy(scopes, "foo.baz.*"))
+	scopes = []string{"foo.*"}
+	assert.True(t, strategy(scopes, "foo.bar"))
+	assert.True(t, strategy(scopes, "foo.baz"))
+	assert.True(t, strategy(scopes, "foo.bar.baz"))
+	assert.False(t, strategy(scopes, "foo"))
 
-	scopes = []string{"foo..bar"}
+	scopes = []string{"foo.*.baz"}
+	assert.True(t, strategy(scopes, "foo.*.baz"))
+	assert.True(t, strategy(scopes, "foo.bar.baz"))
+	assert.False(t, strategy(scopes, "foo..baz"))
+	assert.False(t, strategy(scopes, "foo.baz"))
+	assert.False(t, strategy(scopes, "foo"))
+	assert.False(t, strategy(scopes, "foo.bar.bar"))
+
+	scopes = []string{"foo.*.bar.*"}
+	assert.True(t, strategy(scopes, "foo.baz.bar.baz"))
+	assert.False(t, strategy(scopes, "foo.baz.baz.bar.baz"))
+	assert.True(t, strategy(scopes, "foo.baz.bar.bar.bar"))
+	assert.False(t, strategy(scopes, "foo.baz.bar"))
+	assert.True(t, strategy(scopes, "foo.*.bar.*.*.*"))
+	assert.True(t, strategy(scopes, "foo.1.bar.1.2.3.4.5"))
+
+	scopes = []string{"foo.*.bar"}
+	assert.True(t, strategy(scopes, "foo.bar.bar"))
+	assert.False(t, strategy(scopes, "foo.bar.bar.bar"))
+	assert.False(t, strategy(scopes, "foo..bar"))
+	assert.False(t, strategy(scopes, "foo.bar..bar"))
+
+	scopes = []string{"foo.*.bar.*.baz.*"}
+	assert.False(t, strategy(scopes, "foo.*.*"))
 	assert.False(t, strategy(scopes, "foo.*.bar"))
+	assert.False(t, strategy(scopes, "foo.baz.*"))
+	assert.False(t, strategy(scopes, "foo.baz.bar"))
+	assert.False(t, strategy(scopes, "foo.b*.bar"))
+	assert.True(t, strategy(scopes, "foo.bar.bar.baz.baz.baz"))
+	assert.True(t, strategy(scopes, "foo.bar.bar.baz.baz.baz.baz"))
+	assert.False(t, strategy(scopes, "foo.bar.bar.baz.baz"))
+	assert.False(t, strategy(scopes, "foo.bar.baz.baz.baz.bar"))
 }
diff --git a/session_test.go b/session_test.go
@@ -11,4 +11,4 @@ func TestSession(t *testing.T) {
 	assert.Empty(t, s.GetSubject())
 	assert.Empty(t, s.GetUsername())
 	assert.Nil(t, s.Clone())
-}
+}
diff --git a/token/jwt/claims_test.go b/token/jwt/claims_test.go
@@ -2,8 +2,9 @@ package jwt
 
 import (
 	"testing"
-	"github.com/stretchr/testify/assert"
 	"time"
+
+	"github.com/stretchr/testify/assert"
 )
 
 func TestToString(t *testing.T) {