package idp
import (
"encoding/json"
"net/http"
"net/http/httptest"
"strings"
"testing"
"github.com/gin-gonic/gin"
"github.com/stretchr/testify/require"
"go.uber.org/zap"
"go.uber.org/zap/zaptest/observer"
)
func TestRegistrationRejectionLogsOnlySafeMetadata(t *testing.T) {
for _, tc := range []struct {
name, body, reason, field, issue string
}{
{
name: "redirect policy",
body: `{
"redirect_uris": ["https://username:private-password@oauth-redirect-sandbox.googleusercontent.com/r/private-path?code=private-code#private-fragment"],
"client_name": "private-name",
"scope": "private-scope"
}`,
reason: "redirect_policy", issue: "userinfo",
},
{
name: "encoded path",
body: `{"redirect_uris":["https://oauth-redirect-sandbox.googleusercontent.com/r/private%2Fpath"]}`,
reason: "redirect_policy", issue: "encoded_path",
},
{
name: "unmatched prefix",
body: `{"redirect_uris":["https://oauth-redirect-sandbox.googleusercontent.com/private-path"]}`,
reason: "redirect_policy", issue: "unmatched_prefix",
},
{
name: "metadata type",
body: `{
"scope": ["private-scope"],
"redirect_uris": ["https://oauth-redirect-sandbox.googleusercontent.com/r/private-path?code=private-code"]
}`,
reason: "invalid_json", field: "scope", issue: "query",
},
} {
t.Run(tc.name, func(t *testing.T) {
gin.SetMode(gin.TestMode)
core, logs := observer.New(zap.WarnLevel)
idp := &IDPRouter{
logger: zap.New(core), redirectRestricted: true,
redirectPrefixes: "https://oauth-redirect.googleusercontent.com/r/",
}
router := gin.New()
router.POST("/register", idp.handleRegister)
req := httptest.NewRequest(http.MethodPost, "/register", strings.NewReader(tc.body))
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer private-bearer")
req.Header.Set("Cookie", "session=private-cookie")
response := httptest.NewRecorder()
router.ServeHTTP(response, req)
require.Equal(t, http.StatusBadRequest, response.Code)
require.Len(t, logs.All(), 1)
fields := logs.All()[0].ContextMap()
require.Equal(t, tc.reason, fields["reason"])
require.Equal(t, []interface{}{tc.issue}, fields["redirect_issues"])
if tc.field != "" {
require.Equal(t, tc.field, fields["field"])
require.Equal(t, "array", fields["received_type"])
}
encoded, err := json.Marshal(fields)
require.NoError(t, err)
require.NotContains(t, string(encoded), "private-")
require.Contains(t, string(encoded), "https://oauth-redirect-sandbox.googleusercontent.com")
})
}
}
func TestRegistrationRejectionBoundsLoggedOrigins(t *testing.T) {
core, logs := observer.New(zap.WarnLevel)
idp := &IDPRouter{logger: zap.New(core)}
idp.logRegistrationRejection("redirect_policy", registrationRequest{RedirectURIs: make([]string, 100)}, nil)
fields := logs.All()[0].ContextMap()
require.Equal(t, int64(100), fields["redirect_count"])
require.Len(t, fields["redirect_origins"], 8)
require.Len(t, fields["redirect_issues"], 8)
}