Merge lp:~facundo/canonical-identity-provider/trunk into lp:canonical-identity-provider/release

[Facundo Batista]

Don't crash if the macaroon's caveat_id doesn't validate ok.

Don't crash if the macaroon's caveat_id doesn't validate ok.

[Matias Bordese (matiasb)]

LGTM, thanks

review: Approve

=== modified file 'src/identityprovider/tests/test_views_server.py'
--- src/identityprovider/tests/test_views_server.py	2016-07-07 01:20:50 +0000
+++ src/identityprovider/tests/test_views_server.py	2016-07-12 15:42:04 +0000
@@ -1,5 +1,5 @@
 # -*- coding: utf-8 -*-
-# Copyright 2010, 2012 Canonical Ltd.  This software is licensed under
+# Copyright 2010-2016 Canonical Ltd.  This software is licensed under
 # the GNU Affero General Public License version 3 (see the file
 # LICENSE).
 
@@ -234,6 +234,26 @@
             sreg=['fullname'],
             root_macaroon=root_macaroon, macaroon_key=macaroon_random_key)
 
+    def test_handle_user_response_auto_auth_bad_discharge_macaroon(self):
+        # update rp to auto authorize
+        self.rpconfig.auto_authorize = True
+        self.rpconfig.save()
+
+        self.client.login(username=self.email, password=DEFAULT_USER_PASSWORD)
+        self.params.update({
+            'openid.ns.macaroon': MACAROON_NS,
+            'openid.macaroon.caveat_id': b'broken',
+        })
+        response = self.client.post(self.url, self.params)
+        self.assertEqual(response.status_code, 302)
+
+        query = self.get_query(response)
+        self.assertNotIn('openid.macaroon.discharge', query)
+        openid_identity_url = quote_plus(self.request.build_absolute_uri(
+            self.account.get_absolute_url()))
+        self.assertEqual(query['openid.identity'], openid_identity_url)
+        self.assertEqual(query['openid.claimed_id'], openid_identity_url)
+
     def _test_auto_auth(self, ax=None, sreg=None,
                         root_macaroon=None, macaroon_key=None):
         # update rp to auto authorize

=== modified file 'src/identityprovider/views/server.py'
--- src/identityprovider/views/server.py	2016-06-24 23:04:37 +0000
+++ src/identityprovider/views/server.py	2016-07-12 15:42:04 +0000
@@ -1,4 +1,4 @@
-# Copyright 2010, 2012 Canonical Ltd.  This software is licensed under
+# Copyright 2010-2016 Canonical Ltd.  This software is licensed under
 # the GNU Affero General Public License version 3 (see the file
 # LICENSE).
 
@@ -43,7 +43,7 @@
 from openid.yadis.constants import YADIS_HEADER_NAME
 
 from identityprovider import signed
-from identityprovider.auth import build_discharge_macaroon
+from identityprovider.auth import build_discharge_macaroon, ValidationError
 from identityprovider.const import (
     AX_DATA_FIELDS,
     MACAROON_NS,
@@ -771,8 +771,11 @@
     form = MacaroonRequestForm(
         request, macaroon_request, rpconfig, openid_request.trust_root)
     if form.data_approved_for_request:
-        discharge_macaroon = build_discharge_macaroon(
-            request.user, macaroon_request.caveat_id)
+        try:
+            discharge_macaroon = build_discharge_macaroon(
+                request.user, macaroon_request.caveat_id)
+        except ValidationError:
+            return
         macaroon_response = MacaroonResponse.extractResponse(
             macaroon_request, discharge_macaroon.serialize())
         openid_response.addExtension(macaroon_response)