micolous

Feedback from https://github.com/metrodroid/metrodroid/issues/880#issuecomment-3546386528 Dependency metadata added to the APK/AABs as an encrypted blob, which is a potential source of non-determinism that is difficult to debug, and is useless to anyone...

Fix a number of issues relating to `nom` decoding `[u8]` buffers as UTF-8 when it shouldn't (#1679): * `escaped`, `escape_transform` now accept `control_char: impl AsChar`, rather than `char`. This allows...

salsa20: support insecure 16-byte keys

6

Fixes #432. This adds a `KeySize` parameter to `SalsaCore` (like RC4), and sets it to `U32` by default, for compatibility with existing code. I had a look at implementing 10...

`salsa20`: support 16 byte keys

2

16 and 10 byte keys use different constants, as [described in the Salsa20 paper](https://cr.yp.to/snuffle/salsafamily-20071225.pdf): > The diagonal constants are the same for every block, every nonce, and every > 32-byte...

Token Refreshes with bogus `refresh_token` produces valid JWT

3

Follow-on from #815, using this test script: https://gist.github.com/micolous/e54b84dec86fcc45754c5c429ed834c4 `mock-oauth2-server` returns valid `id_token`s when sent a bogus `refresh_token` (random UUID), as long as it includes a `client_id` parameter _or_ HTTP Basic...

Providing HTTP Basic Auth causes `mock-oauth2-server` to ignore `requestMappings`

3

Follow on from #815 Now with a new test script: https://gist.github.com/micolous/e54b84dec86fcc45754c5c429ed834c4 Whenever a client uses HTTP Basic authentication to provide its `client_id`, claims from the `tokenCallbacks[].requestMappings[].claims` config option are missing....

Auth Code flow with incorrect PKCE `code_challenge` works correctly on the 2nd attempt

4

**Edit (2025-03-21):** I've discovered a mistake in my PKCE implementation: the `code_challenge` value included Base64 padding. Removing that padding fixes the issue, [but it looks like `mock-oauth2-server` accepts incorrect `code_challenge`...