#252645680

Committed 16 Nov 2023 02:50PM UTC coverage: 70.598% (-1.7%) from 72.267%

Build Type

Committed by

Commit Message

from 6 issues; session validation fix (cover cases with empty objects in headers and session)

Pull Request Pull Request #456: staging version 1.9.2491

Run Details

1740 of 3422 branches covered (0.0%)

Branch coverage included in aggregate %.

146 of 298 new or added lines in 20 files covered. (48.99%)

124 existing lines in 24 files now uncovered.

8047 of 10441 relevant lines covered (77.07%)

11.27 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

39.74

/lib/thinx/oauth-github.js

var axios = require('axios');

var events = require('events');
var url = require('url');
var crypto = require('crypto');

module.exports = function (opts) {
  if (!opts.callbackURI) opts.callbackURI = '/github/callback';
  if (!opts.loginURI) opts.loginURI = '/github/login';
  if (typeof opts.scope === 'undefined') opts.scope = 'user';
  var internalState = crypto.randomBytes(8).toString('hex');
  var urlObj = url.parse(opts.baseURL);
  urlObj.pathname = url.resolve(urlObj.pathname, opts.callbackURI);
  var redirectURI = url.format(urlObj);
  var emitter = new events.EventEmitter();

  function login(req, resp) {
    internalState = crypto.randomBytes(8).toString('hex');
    var u = 'https://github.com/login/oauth/authorize'
      + '?client_id=' + opts.githubClient
      + (opts.scope ? '&scope=' + opts.scope : '')
      + '&redirect_uri=' + redirectURI
      + '&state=' + internalState
      ;
    resp.statusCode = 302;
    resp.setHeader('location', u);
    resp.end();
  }

  function parseResponse(body) {
    const items = body.split("&");
    var data = null;
    items.forEach(() => {
      const kv = items[0].split("=");
      const key = kv[0];
      const val = kv[1];
      if (key.indexOf("access_token" !== -1)) {
        data = val;
      }
    });
    return data;
  }



  function callback(code, state, resp, cb) {
    // sample values: &code=d186aa2b6c2663e258ee&state=8df9aee854f9a6d3',
    // minimum (expected) code length = 20 characters
    // validation regex: [a-z0-9]
    // GET /api/oauth/github/callback?code=d4cce4d757b9a20699ca&state=7df9aee854f9a6d2 

    const codeIsValid = (/^([a-z0-9]{20,})$/.test(code));
    if (!codeIsValid) {
      const rbody = resp.body;
      console.log("[debug] [oauth-github] missing or invalid oauth code in ", { rbody });
      return emitter.emit('error', { error: 'missing or invalid oauth code' }, resp);
    }

    const stateIsValid = (/^([a-z0-9]{16,})$/.test(state));
    if (!stateIsValid) {
      const rbody = resp.body;
      console.log("[debug] [oauth-github] missing or invalid oauth state in ", { rbody });
      return emitter.emit('error', { error: 'missing or invalid oauth state' }, resp);
    }

    console.log(("[debug] [oauth-github] Requesting access token with state", {state}, "vs. internalState", {internalState}, "code", {code}));

    if (state.indexOf(internalState) == 0) {
      console.log("[debug] [oauth-github] State is valid internal state.");
    } else {
      console.log("[debug] [oauth-github] State is valid but externally set before access_token request!");
    }

    var u = 'https://github.com/login/oauth/access_token'
      + '?client_id=' + opts.githubClient
      + '&client_secret=' + opts.githubSecret
      + '&code=' + String(code).replace("&", "").replace("=", "").replace("%00", "").replace("%", "")
      + '&state=' + String(state).replace("&", "").replace("=", "").replace("%00", "").replace("%", "")
      ;

    (async () => {
      try {
        const body = await axios.get(u);
        const data = parseResponse(body.data);
        if (data.indexOf("gho_") !== -1) {
          emitter.emit('token', data);
          if (cb) return cb(null, data);
        } else {
          console.log("[debug] Invalid GitHub Response:", { body });
        }
      } catch (e) {
        console.log("axios get error:", e);
        if (cb) return cb(e);
        emitter.emit('error', null, e);
      }
    })();
  }

  emitter.login = login;
  emitter.callback = callback;
  return emitter;
};

1	var axios = require('axios');	1✔
2
3	var events = require('events');	1✔
4	var url = require('url');	1✔
5	var crypto = require('crypto');	1✔
6
7	module.exports = function (opts) {	1✔
8	if (!opts.callbackURI) opts.callbackURI = '/github/callback';	15!
9	if (!opts.loginURI) opts.loginURI = '/github/login';	15!
10	if (typeof opts.scope === 'undefined') opts.scope = 'user';	15!
11	var internalState = crypto.randomBytes(8).toString('hex');	15✔
12	var urlObj = url.parse(opts.baseURL);	15✔
13	urlObj.pathname = url.resolve(urlObj.pathname, opts.callbackURI);	15✔
14	var redirectURI = url.format(urlObj);	15✔
15	var emitter = new events.EventEmitter();	15✔
16
17	function login(req, resp) {
18	internalState = crypto.randomBytes(8).toString('hex');	1✔
19	var u = 'https://github.com/login/oauth/authorize'	1✔
20	+ '?client_id=' + opts.githubClient
21	+ (opts.scope ? '&scope=' + opts.scope : '')	1!
22	+ '&redirect_uri=' + redirectURI
23	+ '&state=' + internalState
24	;
25	resp.statusCode = 302;	1✔
26	resp.setHeader('location', u);	1✔
27	resp.end();	1✔
28	}
29
30	function parseResponse(body) {
31	const items = body.split("&");	×
32	var data = null;	×
NEW 33	items.forEach(() => {	×
34	const kv = items[0].split("=");	×
35	const key = kv[0];	×
36	const val = kv[1];	×
37	if (key.indexOf("access_token" !== -1)) {	×
38	data = val;	×
39	}
40	});
41	return data;	×
42	}
43
44
45
46	function callback(code, state, resp, cb) {
47	// sample values: &code=d186aa2b6c2663e258ee&state=8df9aee854f9a6d3',
48	// minimum (expected) code length = 20 characters
49	// validation regex: [a-z0-9]
50	// GET /api/oauth/github/callback?code=d4cce4d757b9a20699ca&state=7df9aee854f9a6d2
51
52	const codeIsValid = (/^([a-z0-9]{20,})$/.test(code));	2✔
53	if (!codeIsValid) {	2!
54	const rbody = resp.body;	2✔
55	console.log("[debug] [oauth-github] missing or invalid oauth code in ", { rbody });	2✔
56	return emitter.emit('error', { error: 'missing or invalid oauth code' }, resp);	2✔
57	}
58
NEW 59	const stateIsValid = (/^([a-z0-9]{16,})$/.test(state));	×
NEW 60	if (!stateIsValid) {	×
NEW 61	const rbody = resp.body;	×
NEW 62	console.log("[debug] [oauth-github] missing or invalid oauth state in ", { rbody });	×
NEW 63	return emitter.emit('error', { error: 'missing or invalid oauth state' }, resp);	×
64	}
65
NEW 66	console.log(("[debug] [oauth-github] Requesting access token with state", {state}, "vs. internalState", {internalState}, "code", {code}));	×
67
NEW 68	if (state.indexOf(internalState) == 0) {	×
NEW 69	console.log("[debug] [oauth-github] State is valid internal state.");	×
70	} else {
NEW 71	console.log("[debug] [oauth-github] State is valid but externally set before access_token request!");	×
72	}
73
UNCOV 74	var u = 'https://github.com/login/oauth/access_token'	×
75	+ '?client_id=' + opts.githubClient
76	+ '&client_secret=' + opts.githubSecret
77	+ '&code=' + String(code).replace("&", "").replace("=", "").replace("%00", "").replace("%", "")
78	+ '&state=' + String(state).replace("&", "").replace("=", "").replace("%00", "").replace("%", "")
79	;
80
81	(async () => {	×
82	try {	×
83	const body = await axios.get(u);	×
84	const data = parseResponse(body.data);	×
85	if (data.indexOf("gho_") !== -1) {	×
86	emitter.emit('token', data);	×
87	if (cb) return cb(null, data);	×
88	} else {
NEW 89	console.log("[debug] Invalid GitHub Response:", { body });	×
90	}
91	} catch (e) {
92	console.log("axios get error:", e);	×
93	if (cb) return cb(e);	×
94	emitter.emit('error', null, e);	×
95	}
96	})();
97	}
98
99	emitter.login = login;	15✔
100	emitter.callback = callback;	15✔
101	return emitter;	15✔
102	};

suculent / thinx-device-api / #252645680

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous