Query string encoding bug

[IDGuy]

I believe there is an issue with the RemoveBewitFromQuery method.

Using the example URL below which contains encoded characters in the query string:

http://www.example.org/test?path=%2Fmovie%2Fcomedy%2F2014

The Hawk.GetBewit method will compute the MAC using the encoded path and query string above. No issues there.

However the Hawk.AuthenticateBewit method when calculating the MAC removes the bewit. In doing so it recreates the query string which removes the encoding so the MAC ends up using an un-encoded path and query string i.e.

test?path=/movie/comedy/2014

This results in a different MAC and therefore a "Bad mac" SecurityException is thrown.

The issue relates to the code below: Hawk.cs > RemoveBewitFromQuery() var resultingQuery = string.Join("&", parsedQueryString.Cast().Select(e => e + "=" + parsedQueryString[e]).ToArray());

Changing this to: var resultingQuery = parsedQueryString.ToString();

Resolves the issue.

[pcibraro]

I need to find a better way to parse the query string. parsedQueryString.ToString() does not resolve the problem as HttpUtility.ParseQueryString is lowering all the letters in the URL as well.

[pcibraro]

Fixed