Skip to content

Conversation

@robertodoering
Copy link
Collaborator

Hi @kaetemi,
there is an issue where some characters in the parameters don't get encoded properly, causing the oauth signature to be invalid.

This package uses the Uri.encodeComponent(param) to encode the params.
Uri.encodeComponent(param) encodes all characters except letters, numbers and -_.!~*'().
However the oauth1.0a specs define all characters except letters, numbers and -_.~ need to be percent-encoded (See https://oauth.net/core/1.0a/#encoding_parameters)

In this PR I simply replaced all occurrences of the characters that are not accounted for in Uri.encodeComponent(param) for with their percent encoded value.

I also added a changelog and raised the version number.

@robertodoering
Copy link
Collaborator Author

Hey @kaetemi, any plans to merge this?

@kaetemi
Copy link
Member

kaetemi commented Dec 2, 2020

Sorry, missed the PR mail. I'll check.

@kaetemi
Copy link
Member

kaetemi commented Dec 2, 2020

Looks OK, I'll merge it tomorrow.

Does that imply Uri.encodeComponent is not actually standards compliant?

@robertodoering
Copy link
Collaborator Author

Thanks!
Uri.encodeComponent follows the RFC 2396 standard which specifies a set of characters to encode that differs from the RFC 3986 standard that oauth1 uses.
Basically oauth1 uses an older version of the URI standard and thus require some additional characters to be percent encoded.

@kaetemi
Copy link
Member

kaetemi commented Dec 3, 2020

Aha. Interesting. I wonder why, since that appears to be a very old draft of the same standard.

@kaetemi kaetemi merged commit 7af7241 into nbspou:fork/nbspou Dec 3, 2020
@kaetemi
Copy link
Member

kaetemi commented Dec 3, 2020

Pushed to pub, thanks! :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants