Skip to content

Check Response Code before using conn.getInputStream #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 18, 2017
Merged

Check Response Code before using conn.getInputStream #144

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions library/java/net/openid/appauth/AuthorizationService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -345,7 +345,12 @@ protected JSONObject doInBackground(Void... voids) {
wr.write(queryData);
wr.flush();

is = conn.getInputStream();
if (conn.getResponseCode() >= HttpURLConnection.HTTP_OK
&& conn.getResponseCode() < HttpURLConnection.HTTP_MULT_CHOICE) {
is = conn.getInputStream();
} else {
is = conn.getErrorStream();
}
String response = Utils.readInputStream(is);
return new JSONObject(response);
} catch (IOException ex) {
Expand Down Expand Up @@ -378,7 +383,7 @@ protected void onPostExecute(JSONObject json) {
error,
json.getString(AuthorizationException.PARAM_ERROR_DESCRIPTION),
UriUtil.parseUriIfAvailable(
json.getString(AuthorizationException.PARAM_ERROR_URI)));
json.optString(AuthorizationException.PARAM_ERROR_URI)));
} catch (JSONException jsonEx) {
ex = AuthorizationException.fromTemplate(
GeneralErrors.JSON_DESERIALIZATION_ERROR,
Expand Down
42 changes: 42 additions & 0 deletions library/javatests/net/openid/appauth/AuthorizationServiceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,12 @@ public class AuthorizationServiceTest {
+ " \"application_type\": " + RegistrationRequest.APPLICATION_TYPE_NATIVE + "\n"
+ "}";

private static final String INVALID_GRANT_RESPONSE_JSON = "{\n"
+ " \"error\": \"invalid_grant\",\n"
+ " \"error_description\": \"invalid_grant description\"\n"
+ "}";
private static final int TEST_INVALID_GRANT_CODE = 2002;

private AuthorizationCallback mAuthCallback;
private RegistrationCallback mRegistrationCallback;
private AuthorizationService mService;
Expand Down Expand Up @@ -170,6 +176,7 @@ public void testAuthorizationRequest_afterDispose() throws Exception {
public void testTokenRequest() throws Exception {
InputStream is = new ByteArrayInputStream(AUTH_CODE_EXCHANGE_RESPONSE_JSON.getBytes());
when(mHttpConnection.getInputStream()).thenReturn(is);
when(mHttpConnection.getResponseCode()).thenReturn(HttpURLConnection.HTTP_OK);
TokenRequest request = getTestAuthCodeExchangeRequest();
mService.performTokenRequest(request, mAuthCallback);
mAuthCallback.waitForCallback();
Expand All @@ -182,6 +189,7 @@ public void testTokenRequest() throws Exception {
public void testTokenRequest_withBasicAuth() throws Exception {
ClientSecretBasic csb = new ClientSecretBasic(TEST_CLIENT_SECRET);
InputStream is = new ByteArrayInputStream(AUTH_CODE_EXCHANGE_RESPONSE_JSON.getBytes());
when(mHttpConnection.getResponseCode()).thenReturn(HttpURLConnection.HTTP_OK);
when(mHttpConnection.getInputStream()).thenReturn(is);
TokenRequest request = getTestAuthCodeExchangeRequest();
mService.performTokenRequest(request, csb, mAuthCallback);
Expand All @@ -198,6 +206,7 @@ public void testTokenRequest_withPostAuth() throws Exception {
ClientSecretPost csp = new ClientSecretPost(TEST_CLIENT_SECRET);
InputStream is = new ByteArrayInputStream(AUTH_CODE_EXCHANGE_RESPONSE_JSON.getBytes());
when(mHttpConnection.getInputStream()).thenReturn(is);
when(mHttpConnection.getResponseCode()).thenReturn(HttpURLConnection.HTTP_OK);
TokenRequest request = getTestAuthCodeExchangeRequest();
mService.performTokenRequest(request, csp, mAuthCallback);
mAuthCallback.waitForCallback();
Expand All @@ -209,10 +218,35 @@ public void testTokenRequest_withPostAuth() throws Exception {
assertTokenRequestBody(postBody, expectedRequestBody);
}

@Test
public void testTokenRequest_withInvalidGrant() throws Exception {
ClientSecretPost csp = new ClientSecretPost(TEST_CLIENT_SECRET);
InputStream is = new ByteArrayInputStream(INVALID_GRANT_RESPONSE_JSON.getBytes());
when(mHttpConnection.getErrorStream()).thenReturn(is);
when(mHttpConnection.getResponseCode()).thenReturn(HttpURLConnection.HTTP_BAD_REQUEST);
TokenRequest request = getTestAuthCodeExchangeRequest();
mService.performTokenRequest(request, csp, mAuthCallback);
mAuthCallback.waitForCallback();
assertInvalidGrant(mAuthCallback.error);
}

@Test
public void testTokenRequest_withInvalidGrant2() throws Exception {
ClientSecretPost csp = new ClientSecretPost(TEST_CLIENT_SECRET);
InputStream is = new ByteArrayInputStream(INVALID_GRANT_RESPONSE_JSON.getBytes());
when(mHttpConnection.getErrorStream()).thenReturn(is);
when(mHttpConnection.getResponseCode()).thenReturn(199);
TokenRequest request = getTestAuthCodeExchangeRequest();
mService.performTokenRequest(request, csp, mAuthCallback);
mAuthCallback.waitForCallback();
assertInvalidGrant(mAuthCallback.error);
}

@Test
public void testTokenRequest_IoException() throws Exception {
Exception ex = new IOException();
when(mHttpConnection.getInputStream()).thenThrow(ex);
when(mHttpConnection.getResponseCode()).thenReturn(HttpURLConnection.HTTP_OK);
mService.performTokenRequest(getTestAuthCodeExchangeRequest(), mAuthCallback);
mAuthCallback.waitForCallback();
assertNotNull(mAuthCallback.error);
Expand Down Expand Up @@ -272,6 +306,14 @@ private void assertTokenResponse(TokenResponse response, TokenRequest expectedRe
assertEquals(TEST_ID_TOKEN, response.idToken);
}

private void assertInvalidGrant(AuthorizationException error) {
assertNotNull(error);
assertEquals(AuthorizationException.TYPE_OAUTH_TOKEN_ERROR, error.type);
assertEquals(TEST_INVALID_GRANT_CODE, error.code);
assertEquals("invalid_grant", error.error);
assertEquals("invalid_grant description", error.errorDescription);
}

private void assertRegistrationResponse(RegistrationResponse response,
RegistrationRequest expectedRequest) {
assertThat(response).isNotNull();
Expand Down