Asquera / warden-hmac-authentication

A tiny HMAC implementation and warden strategy
MIT License
56 stars 19 forks source link

hmac signer breaks with query value "%" #25

Closed mmack closed 11 years ago

mmack commented 11 years ago

Hey together,

If you pass a simple "%" symbol as a query value to the hmac signer it breaks with "ArgumentError: invalid %-encoding (%)".

1.9.3p194 :001 > require 'uri'
 => true
1.9.3p194 :002 > require 'addressable/uri'
 => true
1.9.3p194 :003 > require 'hmac/signer'
 => true
1.9.3p194 :004 > uri = Addressable::URI.parse "http://www.google.de"
 => #<Addressable::URI:0x3ff1e4cfcb94 URI:http://www.google.de>
1.9.3p194 :005 > uri.query_values = {:name => "%"}
 => {:name=>"%"}
1.9.3p194 :006 > HMAC::Signer.new.sign_url(uri.to_s, "123")
ArgumentError: invalid %-encoding (%)
    from /Users/mmack/.rvm/rubies/ruby-1.9.3-p194/lib/ruby/1.9.1/uri/common.rb:898:in `decode_www_form_component'
    from /Users/mmack/.rvm/gems/ruby-1.9.3-p194/gems/rack-1.4.1/lib/rack/utils.rb:39:in `unescape'
    from /Users/mmack/.rvm/gems/ruby-1.9.3-p194/gems/warden-hmac-authentication-0.6.3/lib/hmac/signer.rb:176:in `block in canonical_representation'
    from /Users/mmack/.rvm/gems/ruby-1.9.3-p194/gems/warden-hmac-authentication-0.6.3/lib/hmac/signer.rb:173:in `map'
    from /Users/mmack/.rvm/gems/ruby-1.9.3-p194/gems/warden-hmac-authentication-0.6.3/lib/hmac/signer.rb:173:in `canonical_representation'
    from /Users/mmack/.rvm/gems/ruby-1.9.3-p194/gems/warden-hmac-authentication-0.6.3/lib/hmac/signer.rb:79:in `generate_signature'
    from /Users/mmack/.rvm/gems/ruby-1.9.3-p194/gems/warden-hmac-authentication-0.6.3/lib/hmac/signer.rb:226:in `sign_request'
    from /Users/mmack/.rvm/gems/ruby-1.9.3-p194/gems/warden-hmac-authentication-0.6.3/lib/hmac/signer.rb:266:in `sign_url'
    from (irb):6
    from /Users/mmack/.rvm/rubies/ruby-1.9.3-p194/bin/irb:16:in `<main>'
1.9.3p194 :007 >
Xylakant commented 11 years ago

The % sign is not a valid character in the query string. It's used to escape other characters - if you want a literal % sign, use the escaped form.