public
Rubygem
Description: OAuth implementation for Ruby
Homepage: http://oauth.net
Clone URL: git://github.com/pelle/oauth.git
Fixed behavior where POST params in the request body were being included in the 
SBS even when not encoded as application/x-www-form-urlencoded.
stmpjmpr (author)
Wed Sep 03 14:04:47 -0700 2008
commit  5cabd84b3c712cd3f615af174f127a47d7010561
tree    49b2ad6ad6dcbd3252dc00946e87fce2bdd30aa6
parent  f8dbb689b5723dd19556119c0c0481b4e90b0a69
...
44
45
46
47
 
 
 
 
48
49
50
...
44
45
46
 
47
48
49
50
51
52
53
0
@@ -44,7 +44,10 @@ module OAuth::RequestProxy::Net
0
       end
0
 
0
       def query_string
0
-        [ query_params, post_params, auth_header_params ].compact.join('&')
0
+        params = [ query_params, auth_header_params ]
0
+        is_form_urlencoded = request['Content-Type'] != nil && request['Content-Type'].downcase == 'application/x-www-form-urlencoded'
0
+        params << post_params if method.to_s.upcase == 'POST' && is_form_urlencoded
0
+        params.compact.join('&')
0
       end
0
       
0
       def query_params
...
129
130
131
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
132
133
134
...
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
0
@@ -129,6 +129,36 @@ class NetHTTPClientTest < Test::Unit::TestCase
0
 #    assert_equal request['authorization'],response.body
0
     assert_equal "oauth_token=requestkey&oauth_token_secret=requestsecret",response.body
0
   end
0
+  
0
+  def test_that_put_bodies_not_signed
0
+    request = Net::HTTP::Put.new(@request_uri.path)
0
+    request.body = "<?xml version=\"1.0\"?><foo><bar>baz</bar></foo>"
0
+    request["Content-Type"] = "application/xml"
0
+    signature_base_string=request.signature_base_string(@http, @consumer, nil, { :nonce => @nonce, :timestamp => @timestamp })
0
+    assert_equal "PUT&http%3A%2F%2Fexample.com%2Ftest&oauth_consumer_key%3Dconsumer_key_86cad9%26oauth_nonce%3D225579211881198842005988698334675835446%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1199645624%26oauth_token%3D%26oauth_version%3D1.0", signature_base_string
0
+  end
0
+
0
+  def test_that_put_bodies_not_signed_even_if_form_urlencoded
0
+    request = Net::HTTP::Put.new(@request_uri.path)
0
+    request.set_form_data( { 'key2' => 'value2' } )
0
+    signature_base_string=request.signature_base_string(@http, @consumer, nil, { :nonce => @nonce, :timestamp => @timestamp })
0
+    assert_equal "PUT&http%3A%2F%2Fexample.com%2Ftest&oauth_consumer_key%3Dconsumer_key_86cad9%26oauth_nonce%3D225579211881198842005988698334675835446%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1199645624%26oauth_token%3D%26oauth_version%3D1.0", signature_base_string
0
+  end
0
+  
0
+  def test_that_post_bodies_signed_if_form_urlencoded
0
+    request = Net::HTTP::Post.new(@request_uri.path)
0
+    request.set_form_data( { 'key2' => 'value2' } )
0
+    signature_base_string=request.signature_base_string(@http, @consumer, nil, { :nonce => @nonce, :timestamp => @timestamp })
0
+    assert_equal "POST&http%3A%2F%2Fexample.com%2Ftest&key2%3Dvalue2%26oauth_consumer_key%3Dconsumer_key_86cad9%26oauth_nonce%3D225579211881198842005988698334675835446%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1199645624%26oauth_token%3D%26oauth_version%3D1.0", signature_base_string
0
+  end
0
+  
0
+  def test_that_post_bodies_not_signed_if_other_content_type
0
+    request = Net::HTTP::Post.new(@request_uri.path)
0
+    request.body = "<?xml version=\"1.0\"?><foo><bar>baz</bar></foo>"
0
+    request["Content-Type"] = "application/xml"
0
+    signature_base_string=request.signature_base_string(@http, @consumer, nil, { :nonce => @nonce, :timestamp => @timestamp })
0
+    assert_equal "POST&http%3A%2F%2Fexample.com%2Ftest&oauth_consumer_key%3Dconsumer_key_86cad9%26oauth_nonce%3D225579211881198842005988698334675835446%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1199645624%26oauth_token%3D%26oauth_version%3D1.0", signature_base_string
0
+  end
0
 
0
   protected
0
 

Comments