OAuth in iwhd preview patch

Jim Meyering jim at meyering.net
Mon Oct 3 20:33:07 UTC 2011


Pete Zaitcev wrote:
> Below is what I have now for 2-legged OAuth in iwhd. It actually works,
> with oauthtest2 from liboauth.
>
> The patch is only a small piece, since it has no client, which we need
> to run the tests, has no documentation, and no user list. However, it
> retires most of the risk. We know that it can be done, this way.
> The biggest risk left is interoperability with Aeolus.
>
> BTW, the OAuth header looks like this:
>
>  Authorization: OAuth realm="http://example.org/", oauth_consumer_key="chiaki",
>   oauth_nonce="mitPzrhrCMHABJiYava_", oauth_signature_method="HMAC-SHA1",
>   oauth_timestamp="1317182031", oauth_version="1.0",
>   oauth_signature="Ya36%2FkXTG5YATRx%2BWAXK9NXzZCg%3D"

Hi Pete,

I noticed that sig_supplied and sig_calculated can both
end up being NULL, either because they were absent or because
strdup failed.  Best not to dereference NULL ;-)

Here's one way to do it, just piggy-backing on the generic
OAuth signature mismatch.  It's probably better to diagnose
things individually.

Actually, it would be better still to change the oauth_param
function to let the caller distinguish between missing parameter
and strdup failure.  Those are so different that they deserve
different diagnostics.

diff --git a/rest.c b/rest.c
index 6d5a146..95d3138 100644
--- a/rest.c
+++ b/rest.c
@@ -2532,7 +2532,8 @@ do_oauth (struct MHD_Connection *conn, my_state *ms,
 	}
 	sig_calculated = oauth_param_val(oargv[x]);

-	if (strcmp(sig_supplied, sig_calculated) != 0) {
+	if (sig_supplied == NULL || sig_calculated == NULL
+	    || strcmp(sig_supplied, sig_calculated) != 0) {
 		DPRINTF("OAuth signature mismatch");
 		return -1;
 	}


More information about the iwhd-devel mailing list