doorkeeper 5.9.6 → 5.9.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 233efb73ba5d84b316e665251df23989888d403dd553cd34375891645c00eb14
-  data.tar.gz: eac0e2ca7376e065d96d43c81cafc54931f77386f2b8b2c00d1a69f7ca0f4b93
+  metadata.gz: 3c4d0c4d775062d003452c97290c5fb4308812e17590946b9f8db9922e40f9d7
+  data.tar.gz: 7af434e11413a59e94cf12edd6ddcb088940110fabbd1174f0bacb2869a254da
 SHA512:
-  metadata.gz: 57c525e75aee988ee335c12415b6d0cea2490890a4ae83dbccc5a9e4b16d6589792aa9c9032ccfb38dd63a30cf9d8080ec87913afe31d577cf07baa7ef916497
-  data.tar.gz: 6dd5a81b7fab1497885c73b601459ab6a12245dff817a17fbba3d40c39bf38a45571ef8526a09a3800baeeabd7e148ceefd412d970b5bff19df8d59374b56d74
+  metadata.gz: 1029aa2d0ff981b3d114f656f5b8d17308a946edd9466e7fe93d93fa5b6d1ba3c6873ba6cf628eab86ccb2f50b14507f272d61a0af829f2184963908941bb91c
+  data.tar.gz: 5b474f0a07ba2785acdbadca5d874a0b9e50955bebd0318499f84710cb06b0d1e8d58419ac4b889045e504011ddc88398ffea0c345434df291f0b43cf60fb3d2

data/CHANGELOG.md

@@ -5,6 +5,21 @@ upgrade guides.
 
 User-visible changes worth mentioning.
 
+## 5.9.9
+
+- Fix: `AuthorizedApplicationsController` now answers `401 Unauthorized` instead of running with a `nil` resource owner, which listed and revoked every token that has no resource owner — the ones the client credentials flow issues. Affected host applications are those whose `resource_owner_authenticator` answers `nil` without halting the request itself; the generated initializer's example redirects and is not affected.
+- Fix: `AuthorizationsController#destroy` now validates the client and redirect URI before producing the deny response, and renders — never redirects — when validation fails. Previously the deny path performed no OAuth-layer validation at all, allowing an open redirect to an attacker-controlled origin with the OAuth `state` attached. Also reject unregistered `response_type` values on the authorization endpoint rather than resolving them through the `constantize` fallback.
+- Fix: refuse redirect URIs with a script scheme (`javascript`, `vbscript`, `data`) both when an application is registered and at authorization time, regardless of `forbid_redirect_uri`. Such a URI is never a legitimate redirection endpoint, and with `response_mode=form_post` it became the action of the auto-submitting form the authorization server renders on its own origin. Already stored records with such a URI are now refused with `invalid_redirect_uri` before the consent screen is shown.
+
+## 5.9.8
+
+- [#1938] Fix: a request body ActionDispatch cannot parse (malformed JSON under a JSON content type, say) no longer raises `ActionDispatch::Http::Parameters::ParseError` out of `Doorkeeper::OAuth::Token.from_request` and `doorkeeper_token`. Since 5.9.7 the RFC 6750 §2 multi-method check read the body on every request, so such a request raised even when it carried a valid Bearer header. The body is now treated as carrying no token, the same way ActionDispatch's own `#filtered_parameters` treats that error.
+
+## 5.9.7
+
+- Refuse requests that transmit an access token by more than one method (RFC 6750 §2), instead of silently authorizing with the first configured `access_token_methods` entry that matched and discarding the other tokens. Such a request now fails closed as carrying no usable token (401 `invalid_token`); no calling contract changes. The form-encoded body (§2.2) and the URI query (§2.3) count as two methods even though Rails and Rack merge them into a single `params` hash. The same token repeated across two methods is refused too — §2 forbids the second method, not a disagreement between the two — and a custom callable extractor in `access_token_methods` keeps the historical first-wins behavior and is never invoked more than once. (The strict `invalid_request` (400) answer §3.1 prescribes ships with Doorkeeper 6.0.)
+- [#1925] Internal: pin the development dependency on `json` below 3.0. json 3 removed the positional options Hash from `JSON.parse` and the `quirks_mode` option from `JSON.generate`, both of which Active Support still uses, so the suite could not run on any supported Rails version.
+
 ## 5.9.6
 
 - Reject requests that present more than one client identity (e.g. an `Authorization: Basic` header for one client and a `client_id` parameter naming another) with an `invalid_request` error, instead of authenticating the first extracted identity and silently discarding the other one. A `client_id` sent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply when `client_credentials` is configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — the `client_credentials` option documents that now.
@@ -62,7 +77,6 @@ User-visible changes worth mentioning.
 - [#1779] Only lock previous access token model when creating a new token from its refresh token if revoke_previous_refresh_token_on_use is false
 - [#1778] Ensure that token revocation is idempotent by checking that that token has not already been revoked before revoking.
 
-
 ## 5.8.2
 
 - [#1755] Fix the error message for force_pkce

data/app/controllers/doorkeeper/authorizations_controller.rb

@@ -16,7 +16,13 @@ module Doorkeeper
       redirect_or_render(authorize_response)
     end
 
+    # The deny path answers a request the client sent, so it is subject to the
+    # same client and redirect URI validation as #create: without it an
+    # unregistered redirect_uri was honoured and the user-agent redirected to
+    # it, carrying the OAuth `state` to an origin of the caller's choosing.
     def destroy
+      return if refuse_invalid_client?
+
       redirect_or_render(authorization.deny)
     rescue Doorkeeper::Errors::InvalidTokenStrategy => e
       error_response = get_error_response_from_exception(e)
@@ -45,13 +51,37 @@ module Doorkeeper
 
       if Doorkeeper.configuration.redirect_on_errors? && pre_auth.error_response.redirectable?
         redirect_or_render(pre_auth.error_response)
-      elsif Doorkeeper.configuration.api_only
-        render json: pre_auth.error_response.body, status: pre_auth.error_response.status
       else
-        render :error, locals: { error_response: pre_auth.error_response }, status: pre_auth.error_response.status
+        render_error_response(pre_auth.error_response)
       end
     end
 
+    def render_error_response(error_response)
+      if Doorkeeper.configuration.api_only
+        render json: error_response.body, status: error_response.status
+      else
+        render :error, locals: { error_response: error_response }, status: error_response.status
+      end
+    end
+
+    # Renders the error when the request's client_id or redirect_uri is missing
+    # or invalid, and answers whether the request was refused. Errors are
+    # rendered, never redirected, regardless of `handle_auth_errors :redirect`:
+    # no failure this check can produce leaves a redirect target worth
+    # trusting. Either the client failed first, so the redirect URI was never
+    # reached, or the redirect URI is itself the invalid one - and RFC 6749
+    # Section 3.1.2.4 forbids redirecting the user-agent to an invalid
+    # redirection URI.
+    def refuse_invalid_client?
+      return false if pre_auth.client_valid?
+
+      error_response = pre_auth.error_response
+      error_response.raise_exception! if Doorkeeper.config.raise_on_errors?
+
+      render_error_response(error_response)
+      true
+    end
+
     def can_authorize_response?
       Doorkeeper.config.custom_access_token_attributes.empty? && pre_auth.client.application.confidential? && matching_token?
     end

data/app/controllers/doorkeeper/authorized_applications_controller.rb

@@ -3,6 +3,7 @@
 module Doorkeeper
   class AuthorizedApplicationsController < Doorkeeper::ApplicationController
     before_action :authenticate_resource_owner!
+    before_action :validate_resource_owner
 
     def index
       @applications = Doorkeeper.config.application_model.authorized_for(current_resource_owner)
@@ -29,5 +30,27 @@ module Doorkeeper
         format.json { head :no_content }
       end
     end
+
+    private
+
+    # `authenticate_resource_owner!` hands the request to the host
+    # application's `resource_owner_authenticator` block, which is expected to
+    # halt the request itself — redirect to a sign-in page, raise, render —
+    # when nobody is signed in. A block that merely answers nil halts nothing:
+    # the library default (no block configured) logs a warning and answers
+    # nil, and so does any block written as a bare lookup such as
+    # `User.find_by(id: session[:user_id])`.
+    #
+    # Both actions here scope their work to `current_resource_owner`, and a
+    # nil owner is not "no scope" — it is the scope of the records that have
+    # no resource owner, which is what the client credentials flow issues.
+    # #index would list every application holding one and #destroy would
+    # revoke them, for a caller that never authenticated. So refuse the
+    # request rather than treat "nobody" as an owner. Only this controller is
+    # guarded; `authenticate_resource_owner!` itself is left alone because
+    # AuthorizationsController shapes its own response around the owner.
+    def validate_resource_owner
+      head :unauthorized unless current_resource_owner
+    end
   end
 end

data/lib/doorkeeper/config.rb

@@ -329,7 +329,9 @@ module Doorkeeper
     option :allow_grant_flow_for_client,    default: ->(_grant_flow, _client) { true }
 
     # Allows to forbid specific Application redirect URI's by custom rules.
-    # Doesn't forbid any URI by default.
+    # Doesn't forbid any URI by default. Redirect URIs with a script scheme
+    # (`javascript`, `vbscript`, `data`) are always rejected, regardless of
+    # this option.
     #
     # @param forbid_redirect_uri [Proc] Block or any object respond to #call
     #

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -6,6 +6,15 @@ module Doorkeeper
   module OAuth
     module Helpers
       module URIChecker
+        # Schemes a user agent evaluates in the document that navigates to
+        # them instead of fetching a resource from somewhere else. With
+        # `response_mode=form_post` that document is the authorization
+        # server's own page, so a redirect URI with one of these schemes would
+        # run the client's script on the server's origin. None of them can be
+        # a legitimate redirection endpoint (RFC 6749 Section 3.1.2), so they
+        # are refused regardless of the `forbid_redirect_uri` configuration.
+        SCRIPT_SCHEMES = %w[javascript vbscript data].freeze
+
         def self.valid?(url)
           return true if oob_uri?(url)
 
@@ -62,10 +71,15 @@ module Doorkeeper
 
         def self.valid_scheme?(uri)
           return false if uri.scheme.blank?
+          return false if script_scheme?(uri)
 
           %w[localhost].exclude?(uri.scheme)
         end
 
+        def self.script_scheme?(uri)
+          SCRIPT_SCHEMES.include?(uri.scheme.to_s.downcase)
+        end
+
         def self.hypertext_scheme?(uri)
           %w[http https].include?(uri.scheme)
         end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -5,6 +5,14 @@ module Doorkeeper
     class PreAuthorization
       include Validations
 
+      # The validations that identify the client and its redirect URI. None of
+      # them depend on the resource owner, and none of their failures leaves a
+      # redirect target worth trusting: RFC 6749 Section 4.1.2.1 (Section
+      # 4.2.2.1 for the implicit flow) asks for the resource owner to be
+      # informed when the client_id is missing or invalid, and Section 3.1.2.4
+      # asks the same for the redirect URI.
+      CLIENT_VALIDATIONS = %i[client_id client redirect_uri].freeze
+
       validate :client_id, error: Errors::InvalidRequest
       validate :client, error: Errors::InvalidClient
       validate :client_supports_grant_flow, error: Errors::UnauthorizedClient
@@ -40,6 +48,25 @@ module Doorkeeper
         valid?
       end
 
+      # Runs only CLIENT_VALIDATIONS, in declared order, so a request naming an
+      # unknown client or an invalid redirect URI can be refused on its own -
+      # the validations in between (client_supports_grant_flow,
+      # resource_owner_authorize_for_client) answer a different question and
+      # are left to a full #validate run.
+      def client_valid?
+        @error = nil
+        @missing_param = nil
+
+        self.class.validations.each do |validation|
+          next unless CLIENT_VALIDATIONS.include?(validation[:attribute])
+
+          @error = validation[:options][:error] unless send("validate_#{validation[:attribute]}")
+          break if @error
+        end
+
+        @error.nil?
+      end
+
       def scopes
         Scopes.from_string(scope)
       end

data/lib/doorkeeper/oauth/token.rb

@@ -3,8 +3,54 @@
 module Doorkeeper
   module OAuth
     class Token
+      # Built-in extractors that read a request parameter, and the parameter
+      # each of them reads. RFC 6750 treats the form-encoded body (§2.2) and
+      # the URI query string (§2.3) as two distinct transmission methods, but
+      # Rack and ActionDispatch both collapse them into a single parameter
+      # hash — ActionDispatch lets the query win, Rack lets the body win — so
+      # a request carrying the parameter in both would present a single value
+      # to the extractor and never be refused. The multi-method check reads
+      # the two sources separately for these extractors; selection keeps
+      # using the extractor, so which one wins is unchanged.
+      PARAMETER_EXTRACTORS = {
+        from_access_token_param: "access_token",
+        from_bearer_param: "bearer_token",
+      }.freeze
+
       class << self
+        # RFC 6750 §2: "Clients MUST NOT use more than one method to transmit
+        # the token in each request", and §3.1 lists using more than one method
+        # among the conditions an invalid_request answers. Returning the first
+        # method that yields a value would discard every other token presented
+        # in the same request with no error, warning or log entry, leaving
+        # which token authorizes the request to be decided by the configured
+        # order of +access_token_methods+ rather than by what the caller sent —
+        # so a layer in front of Doorkeeper that reads a different one of them
+        # can reach a different verdict about the very same request.
+        #
+        # What §2 forbids is using more than one method, so the check counts
+        # transmission methods rather than comparing the tokens they carry:
+        # the same value presented twice is still two methods. Refusal answers
+        # nil: the caller is told the request carries no usable token and
+        # fails closed with the invalid_token (401) response, keeping every
+        # calling contract on this stable branch intact — the invalid_request
+        # (400) that §3.1 strictly prescribes needs a new error and render
+        # path, so it ships with 6.0 only.
+        #
+        # Only the built-in extractors — symbols naming methods on this class,
+        # all of them side-effect-free reads of the request — take part in
+        # that check. A custom callable extractor is a configuration adapter
+        # rather than a transmission method: it keeps the historical
+        # first-wins selection and is never invoked more than once, the same
+        # exemption client authentication gives its legacy callable
+        # extractors (Request#validate_client_authentication!).
         def from_request(request, *methods)
+          used = methods.sum do |method|
+            method.is_a?(Symbol) ? transmission_methods_used(request, method) : 0
+          end
+
+          return if used > 1
+
           methods.inject(nil) do |_, method|
             method = self.method(method) if method.is_a?(Symbol)
             credentials = method.call(request)
@@ -23,11 +69,11 @@ module Doorkeeper
         end
 
         def from_access_token_param(request)
-          request.parameters[:access_token]
+          parameters(request)[:access_token]
         end
 
         def from_bearer_param(request)
-          request.parameters[:bearer_token]
+          parameters(request)[:bearer_token]
         end
 
         def from_bearer_authorization(request)
@@ -44,6 +90,53 @@ module Doorkeeper
 
         private
 
+        # How many transmission methods the given built-in extractor finds a
+        # token in. Usually one, or none — but for the parameter extractors
+        # above it is the body and the query counted separately, since the
+        # parameter hash collapsed them into the single value the extractor
+        # reads. That value is counted on its own only when neither raw source
+        # explains it, so a token reaching the extractor by some other route —
+        # an :access_token path segment, or a host that overrode the extractor
+        # — is still counted exactly once rather than twice.
+        def transmission_methods_used(request, method)
+          value = self.method(method).call(request).presence
+
+          parameter = PARAMETER_EXTRACTORS[method]
+          return value ? 1 : 0 unless parameter
+
+          sources = parameter_sources(request, parameter)
+          sources.size + (value && !sources.include?(value) ? 1 : 0)
+        end
+
+        # The form-encoded body (§2.2) and the URI query (§2.3) as Rack
+        # exposes them, for a request object that keeps the two apart.
+        def parameter_sources(request, parameter)
+          return [] unless request.respond_to?(:GET) && request.respond_to?(:POST)
+
+          query = request.GET
+          body = body_parameters(request)
+          return [] unless query.is_a?(Hash) && body.is_a?(Hash)
+
+          [query[parameter], body[parameter]].filter_map(&:presence)
+        end
+
+        # A body ActionDispatch cannot parse — malformed JSON under a JSON
+        # content type, say — carries no token. Reading it must not raise out
+        # of the extractors, which host apps call from places that run after
+        # their own ParseError handling (instrumentation, exception apps), the
+        # same way ActionDispatch's own #filtered_parameters treats that error.
+        def parameters(request)
+          request.parameters
+        rescue ActionDispatch::Http::Parameters::ParseError
+          {}
+        end
+
+        def body_parameters(request)
+          request.POST
+        rescue ActionDispatch::Http::Parameters::ParseError
+          {}
+        end
+
         def token_from_basic_header(header, pattern)
           encoded_header = token_from_header(header, pattern)
           decode_basic_credentials_token(encoded_header)

data/lib/doorkeeper/orm/active_record/redirect_uri_validator.rb

@@ -34,8 +34,12 @@ module Doorkeeper
       Doorkeeper::OAuth::NonStandard::IETF_WG_OAUTH2_OOB_METHODS.include?(uri)
     end
 
+    # Script schemes are refused before the host application's rule is
+    # consulted, so a `forbid_redirect_uri` that rejects them too does not
+    # report the error twice.
     def forbidden_uri?(uri)
-      Doorkeeper.config.forbid_redirect_uri.call(uri)
+      Doorkeeper::OAuth::Helpers::URIChecker.script_scheme?(uri) ||
+        Doorkeeper.config.forbid_redirect_uri.call(uri)
     end
 
     def unspecified_scheme?(uri)

data/lib/doorkeeper/request.rb

@@ -3,18 +3,30 @@
 module Doorkeeper
   module Request
     class << self
+      # Resolves the strategy that answers the given response_type at the
+      # authorization endpoint.
+      #
+      # A response_type no registered authorization flow handles is refused
+      # rather than turned into a class name: `constantize` would otherwise
+      # resolve any constant under Doorkeeper::Request, token endpoint
+      # strategies (`password`, `client_credentials`, `refresh_token`,
+      # `authorization_code`) included, none of which can answer an
+      # authorization request.
       def authorization_strategy(response_type)
+        response_type = response_type.to_s
+
         grant_flow = authorization_flows.detect do |flow|
           flow.matches_response_type?(response_type)
         end
 
-        if grant_flow
-          grant_flow.response_type_strategy
-        else
-          # [NOTE]: this will be removed in a newer versions of Doorkeeper.
-          # For retro-compatibility only
-          build_fallback_strategy_class(response_type)
-        end
+        raise Errors::InvalidTokenStrategy unless grant_flow
+
+        # [NOTE]: this will be removed in a newer versions of Doorkeeper.
+        # For retro-compatibility only: flows declared through the deprecated
+        # Config#calculate_authorization_response_types hook are built as
+        # GrantFlow::FallbackFlow and carry no strategy, so the class is looked
+        # up by name - but only for a response type the server does declare.
+        grant_flow.response_type_strategy || build_fallback_strategy_class(response_type)
       end
 
       def token_strategy(grant_type)

data/lib/doorkeeper/version.rb

@@ -5,7 +5,7 @@ module Doorkeeper
     # Semantic versioning
     MAJOR = 5
     MINOR = 9
-    TINY = 6
+    TINY = 9
     PRE = nil
 
     # Full version number

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -316,10 +316,13 @@ Doorkeeper.configure do
   # Specify what redirect URI's you want to block during Application creation.
   # Any redirect URI is allowed by default.
   #
-  # You can use this option in order to forbid URI's with 'javascript' scheme
+  # Redirect URIs with a script scheme (`javascript`, `vbscript`, `data`) are
+  # always rejected, regardless of this option.
+  #
+  # You can use this option in order to forbid URI's of a particular host
   # for example.
   #
-  # forbid_redirect_uri { |uri| uri.scheme.to_s.downcase == 'javascript' }
+  # forbid_redirect_uri { |uri| uri.host == 'example.com' }
 
   # Allows to set blank redirect URIs for Applications in case Doorkeeper configured
   # to use URI-less OAuth grant flows like Client Credentials or Resource Owner

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.9.6
+  version: 5.9.9
 platform: ruby
 authors:
 - Felipe Elias Philipp
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-11 00:00:00.000000000 Z
+date: 2026-09-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties