Source code
Revision control
Copy as Markdown
// Copyright (C) 2017 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GPL-3.0-only
// Qt-Security score:critical reason:authorization-protocol
#include "qoauthoobreplyhandler.h"
#include "qoauthoobreplyhandler_p.h"
#include <QtCore/qurlquery.h>
#include <QtCore/qjsonobject.h>
#include <QtCore/qjsondocument.h>
#include <QtCore/qloggingcategory.h>
#include <QtNetwork/qnetworkreply.h>
#include <QtNetwork/qrestreply.h>
QT_BEGIN_NAMESPACE
using namespace Qt::StringLiterals;
QOAuthOobReplyHandler::QOAuthOobReplyHandler(QObject *parent)
: QAbstractOAuthReplyHandler(parent)
{}
/*! \internal */
QOAuthOobReplyHandler::QOAuthOobReplyHandler(QOAuthOobReplyHandlerPrivate &d, QObject *parent)
: QAbstractOAuthReplyHandler(d, parent)
{}
QOAuthOobReplyHandler::~QOAuthOobReplyHandler()
= default; // must be empty until Qt 7 (was inline until Qt 6.8)
QString QOAuthOobReplyHandler::callback() const
{
return QStringLiteral("oob");
}
void QOAuthOobReplyHandler::networkReplyFinished(QNetworkReply *reply)
{
QRestReply restReply(reply);
if (restReply.hasError()) {
emit tokenRequestErrorOccurred(QAbstractOAuth::Error::NetworkError, reply->errorString());
return;
}
const bool isHttpStatusSuccess = restReply.isHttpStatusSuccess();
if (reply->header(QNetworkRequest::ContentTypeHeader).isNull()) {
emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError,
u"Empty Content-type header"_s);
return;
}
const QString contentType = reply->header(QNetworkRequest::ContentTypeHeader).isNull() ?
QStringLiteral("text/html") :
reply->header(QNetworkRequest::ContentTypeHeader).toString();
const QByteArray data = reply->readAll();
if (data.isEmpty()) {
emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError, u"No data received"_s);
return;
}
Q_EMIT replyDataReceived(data);
QVariantMap ret;
if (contentType.startsWith(QStringLiteral("text/html")) ||
contentType.startsWith(QStringLiteral("application/x-www-form-urlencoded"))) {
ret = parseResponse(data);
} else if (contentType.startsWith(QStringLiteral("application/json"))
|| contentType.startsWith(QStringLiteral("text/javascript"))) {
const QJsonDocument document = QJsonDocument::fromJson(data);
if (!document.isObject()) {
emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError,
u"Received data is not a JSON object: %1"_s.arg(QString::fromUtf8(data)));
return;
}
const QJsonObject object = document.object();
if (object.isEmpty()) {
emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError,
u"Received an empty JSON object"_s);
return;
}
ret = object.toVariantMap();
} else {
emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError,
u"Unknown Content-type %1"_s.arg(contentType));
return;
}
// RFC 6749 section 5.2 specifies that token endpoint errors are typically
// returned with HTTP status 400. Let tokensReceived() handler report
// the error if it's an actual sever-side reported error. Otherwise error out here
if (!isHttpStatusSuccess && !ret.contains(u"error"_s)) {
emit tokenRequestErrorOccurred(QAbstractOAuth::Error::ServerError, reply->errorString());
return;
}
Q_EMIT tokensReceived(ret);
}
QVariantMap QOAuthOobReplyHandler::parseResponse(const QByteArray &response)
{
QVariantMap ret;
QUrlQuery query(QString::fromUtf8(response));
const auto queryItems = query.queryItems(QUrl::FullyDecoded);
for (auto it = queryItems.begin(), end = queryItems.end(); it != end; ++it)
ret.insert(it->first, it->second);
return ret;
}
QT_END_NAMESPACE
#include "moc_qoauthoobreplyhandler.cpp"