Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use the correct function when validating google auth tokens #5018

Merged
merged 2 commits into from
Aug 31, 2018

Conversation

orette
Copy link
Contributor

@orette orette commented Aug 30, 2018

httpsRequest.request expects the param postData and has no default value
or validation to check if it is missing before using it. As a result, an
error TypeError: First argument must be a string or Buffer is
thrown when an attempt is made to authenticate with Google.

A quick check on the LinkedIn, FB, and twitter authentication adapters shows they are
using httpsRequest.get for their validation calls.

httpsRequest.request expects the param postData and has no default value
or validation to check if it is missing before using it. As a result, an
error `TypeError: First argument must be a string or Buffer` is
thrown when an attempt is made to authenticate with Google.

A quick check on the LinkedIn, FB, and twitter authentication adapters
shows they are using httpsRequest.get for their validation calls.
@flovilmart
Copy link
Contributor

flovilmart commented Aug 30, 2018

You are right, can you update the tests please?

@codecov
Copy link

codecov bot commented Aug 30, 2018

Codecov Report

Merging #5018 into master will increase coverage by 0.01%.
The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #5018      +/-   ##
==========================================
+ Coverage   94.28%   94.29%   +0.01%     
==========================================
  Files         121      121              
  Lines        8760     8760              
==========================================
+ Hits         8259     8260       +1     
+ Misses        501      500       -1
Impacted Files Coverage Δ
src/Adapters/Auth/google.js 100% <100%> (ø) ⬆️
src/RestWrite.js 93.33% <0%> (+0.18%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8c0a443...3ba06bd. Read the comment docs.

@orette
Copy link
Contributor Author

orette commented Aug 30, 2018

@flovilmart I fixed the tests, but also notice two were passing even though the incorrect function was faked. Is it worth adding a check to ensure the correct function is called? eg. expect(httpsRequest.get).toHaveBeenCalledWith('https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=the_token'); or expect(httpsRequest.get).toHaveBeenCalled();

@flovilmart
Copy link
Contributor

notice two were passing even though the incorrect function was faked.

What do you mean by that?

@flovilmart flovilmart merged commit c7357ed into parse-community:master Aug 31, 2018
@orette
Copy link
Contributor Author

orette commented Aug 31, 2018

The two tests 'should fail when the access_token is invalid' and 'should fail when the id_token is invalid' were passing when they should have failed in my opinion. The below code was being used to setup a fake response, but wasn't being called because the call was changed from httpsRequest.request to httpsRequest.get in the function googleRequest from google.js. The tests passed because they are only checking for the exception, but had taken a different execution path from what it should have.

    spyOn(httpsRequest, 'request').and.callFake(() => {
      return Promise.resolve({ sub: 'badId' });
    });

@flovilmart
Copy link
Contributor

Yeah sure, I have been a bit quick when I refactored all the Auth adapters to improve testability. If this is something you want to improve you’re very welcome to do so!

UnderratedDev pushed a commit to UnderratedDev/parse-server that referenced this pull request Mar 21, 2020
…mmunity#5018)

* Use the correct function when validating google auth tokens

httpsRequest.request expects the param postData and has no default value
or validation to check if it is missing before using it. As a result, an
error `TypeError: First argument must be a string or Buffer` is
thrown when an attempt is made to authenticate with Google.

A quick check on the LinkedIn, FB, and twitter authentication adapters
shows they are using httpsRequest.get for their validation calls.

* Correct google auth adapter tests
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants