`Utils::validateHmac` fails if the query params contains non url-safe characters.
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 35/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 停滞
- 技术栈
- php
调研方向
从 Utils::validateHmac 开始，使用包含 Base64 或 JSON 等编码字符的 state 重现 OAuth 回调。跟踪 HMAC 验证之前如何处理回调查询参数；当验证对包含这些字符且签名正确的 URL 返回 true 时，即表示完成。
由索引模型根据 Issue 内容生成。
描述
Issue summary
Utils::validateHmac fails if the query params contains non url-safe characters. For example, for a oauth authorization callback, if the state is a base64-encoded string, the trailing = character will make the HMAC validation fail. After talking with the Shopify support, I was told that the HMAC sent from Shopify is computed based on the original query params, instead of the URL-encoded version.
Expected behavior
HMAC validation should still work if the HMAC comes for a URL containing encoded characters
Actual behavior
Utils::validateHmac returns false, even if I can manually confirm that the HMAC is correct
Steps to reproduce the problem
- Initiate an OAuth autorization request. For the
state, use non url-safe characters (i.e. JSON, Base64, or colons:). In my case, I use an app I'm developping, and requesting access for that app to a test shop. - When the autorization request is accepted, the user is redirected to your
redirect_uriwith the resulting query parameters. Save those for next step - use
Utils::validateHmacto validate the callback. It will fail if thestateindeed contains encoded characters.
Reduced test case
The best way to get your bug fixed is to provide a reduced test case.
Checklist
- I have described this issue in a way that is actionable (if possible)
- 主要语言
- PHP
- 星标
- 473
- 派生
- 193
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
相似的 Issue
-
难度 1/5 1 小时以内 新手友好度 78/100
backdrop-contrib/commerce#60 ·
-
难度 1/5 1 小时以内 新手友好度 76/100
-
难度 1/5 1 小时以内 新手友好度 84/100
TYPO3-Documentation/TYPO3CMS-Reference-CoreApi#7330 ·
维护者通常 1 天内回复
-
dependencies
难度 2/5 1-3 小时 新手友好度 67/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100