uaa
uaa copied to clipboard
cloudfoundry
Revoke access does not work with a client id containing !
SECURITY NOTICE: If you have found a security problem in the UAA, please do not file a public github issue. Instead, please send an email to [email protected]
Thanks for taking the time to file an issue. You'll minimize back and forth and help us help you more effectively by answering all of the following questions as specifically and completely as you can.
What version of UAA are you running?
4.24
What output do you see from curl <YOUR_UAA>/info -H'Accept: application/json'
(hostnames removed)
{
"app": {
"version": "4.24.0"
},
"links": {
"uaa": "https://uaa.##",
"passwd": "https://account##/#/home/welcome",
"login": "https://login.##",
"register": "https://account##/#/home/welcome"
},
"zone_name": "uaa",
"entityID": "login.##",
"commit_id": "16d9900",
"idpDefinitions": {},
"prompts": {
"username": [
"text",
"User ID"
],
"password": [
"password",
"Password"
]
},
"timestamp": "2018-11-06T01:20:26+0000"
}
How are you deploying the UAA?
bosh as part of cf deployment
I am deploying the UAA
- using cf-deployment
What did you do?
Register a OAuth client containing a !, e.g. my-app!s22.
After using the authorization code flow without auto-approve, the application appear on user account (home screen->upper right navigation menu) for revocation. Revocation works for clients without a ! in the id, but fails for clients with a ! in the client id.
Browser console reports the following error:
Uncaught Error: Syntax error, unrecognized expression: #sb-faas-live!s1934-scrim
at Function.fa.error (jquery.js:2)
at fa.tokenize (jquery.js:2)
at fa.select (jquery.js:2)
at Function.fa [as find] (jquery.js:2)
at n.fn.init.find (jquery.js:2)
at new n.fn.init (jquery.js:2)
at n (jquery.js:2)
at HTMLAnchorElement.
What did you expect to see? What goal are you trying to achieve with the UAA?
Confimation dialog if the application should be revoked.
What did you see instead?
Error in the browser console Please include UAA logs if available. Client side issue.
We have created an issue in Pivotal Tracker to manage this:
https://www.pivotaltracker.com/story/show/162364885
The labels on this github issue will be updated when the story is started.
Location missing escaping looks like https://github.com/cloudfoundry/uaa/blob/develop/server/src/main/resources/templates/web/approvals.html#L13
Gitbot story link appears broken ... this looks to be the original story: https://www.pivotaltracker.com/n/projects/2147159/stories/162364885
It seems to me like these special characters shouldn't be allowed in client names in the first place.
