Pete Zaitcev wrote:
Below is what I have now for 2-legged OAuth in iwhd. It actually
works,
with oauthtest2 from liboauth.
The patch is only a small piece, since it has no client, which we need
to run the tests, has no documentation, and no user list. However, it
retires most of the risk. We know that it can be done, this way.
The biggest risk left is interoperability with Aeolus.
BTW, the OAuth header looks like this:
Authorization: OAuth
realm="http://example.org/",
oauth_consumer_key="chiaki",
oauth_nonce="mitPzrhrCMHABJiYava_",
oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1317182031", oauth_version="1.0",
oauth_signature="Ya36%2FkXTG5YATRx%2BWAXK9NXzZCg%3D"
Hi Pete,
I noticed that sig_supplied and sig_calculated can both
end up being NULL, either because they were absent or because
strdup failed. Best not to dereference NULL ;-)
Here's one way to do it, just piggy-backing on the generic
OAuth signature mismatch. It's probably better to diagnose
things individually.
Actually, it would be better still to change the oauth_param
function to let the caller distinguish between missing parameter
and strdup failure. Those are so different that they deserve
different diagnostics.
diff --git a/rest.c b/rest.c
index 6d5a146..95d3138 100644
--- a/rest.c
+++ b/rest.c
@@ -2532,7 +2532,8 @@ do_oauth (struct MHD_Connection *conn, my_state *ms,
}
sig_calculated = oauth_param_val(oargv[x]);
- if (strcmp(sig_supplied, sig_calculated) != 0) {
+ if (sig_supplied == NULL || sig_calculated == NULL
+ || strcmp(sig_supplied, sig_calculated) != 0) {
DPRINTF("OAuth signature mismatch");
return -1;
}