doorkeeper 5.9.7 → 5.9.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b21e3bb3454e1896aa0a0d022741de322d5cf604de408dfe58a1a4ef2a21cfbc
-  data.tar.gz: 9384048264886cad0506a879964635253fb00a4903a6347e7801c066c6f971d3
+  metadata.gz: 3c4d0c4d775062d003452c97290c5fb4308812e17590946b9f8db9922e40f9d7
+  data.tar.gz: 7af434e11413a59e94cf12edd6ddcb088940110fabbd1174f0bacb2869a254da
 SHA512:
-  metadata.gz: 18f0100ea947793a51547ee3de5ffd0927b8c4a6e1a9b491448c4149927ec34521b4d28c45056c5ca0d4b6dd87f79b796167e463f0a4cb1830eb2bf5732fc9b8
-  data.tar.gz: 16c2996fa91d47283fcbf491773d7f2ed4d0e14b8faf0566f6757875de1b31af3ac058e19a77487c74ec13ca6dfde6a619048484b73f5a4bccc9814441a24122
+  metadata.gz: 1029aa2d0ff981b3d114f656f5b8d17308a946edd9466e7fe93d93fa5b6d1ba3c6873ba6cf628eab86ccb2f50b14507f272d61a0af829f2184963908941bb91c
+  data.tar.gz: 5b474f0a07ba2785acdbadca5d874a0b9e50955bebd0318499f84710cb06b0d1e8d58419ac4b889045e504011ddc88398ffea0c345434df291f0b43cf60fb3d2

data/CHANGELOG.md

@@ -5,6 +5,16 @@ upgrade guides.
 
 User-visible changes worth mentioning.
 
+## 5.9.9
+
+- Fix: `AuthorizedApplicationsController` now answers `401 Unauthorized` instead of running with a `nil` resource owner, which listed and revoked every token that has no resource owner — the ones the client credentials flow issues. Affected host applications are those whose `resource_owner_authenticator` answers `nil` without halting the request itself; the generated initializer's example redirects and is not affected.
+- Fix: `AuthorizationsController#destroy` now validates the client and redirect URI before producing the deny response, and renders — never redirects — when validation fails. Previously the deny path performed no OAuth-layer validation at all, allowing an open redirect to an attacker-controlled origin with the OAuth `state` attached. Also reject unregistered `response_type` values on the authorization endpoint rather than resolving them through the `constantize` fallback.
+- Fix: refuse redirect URIs with a script scheme (`javascript`, `vbscript`, `data`) both when an application is registered and at authorization time, regardless of `forbid_redirect_uri`. Such a URI is never a legitimate redirection endpoint, and with `response_mode=form_post` it became the action of the auto-submitting form the authorization server renders on its own origin. Already stored records with such a URI are now refused with `invalid_redirect_uri` before the consent screen is shown.
+
+## 5.9.8
+
+- [#1938] Fix: a request body ActionDispatch cannot parse (malformed JSON under a JSON content type, say) no longer raises `ActionDispatch::Http::Parameters::ParseError` out of `Doorkeeper::OAuth::Token.from_request` and `doorkeeper_token`. Since 5.9.7 the RFC 6750 §2 multi-method check read the body on every request, so such a request raised even when it carried a valid Bearer header. The body is now treated as carrying no token, the same way ActionDispatch's own `#filtered_parameters` treats that error.
+
 ## 5.9.7
 
 - Refuse requests that transmit an access token by more than one method (RFC 6750 §2), instead of silently authorizing with the first configured `access_token_methods` entry that matched and discarding the other tokens. Such a request now fails closed as carrying no usable token (401 `invalid_token`); no calling contract changes. The form-encoded body (§2.2) and the URI query (§2.3) count as two methods even though Rails and Rack merge them into a single `params` hash. The same token repeated across two methods is refused too — §2 forbids the second method, not a disagreement between the two — and a custom callable extractor in `access_token_methods` keeps the historical first-wins behavior and is never invoked more than once. (The strict `invalid_request` (400) answer §3.1 prescribes ships with Doorkeeper 6.0.)

data/app/controllers/doorkeeper/authorizations_controller.rb

@@ -16,7 +16,13 @@ module Doorkeeper
       redirect_or_render(authorize_response)
     end
 
+    # The deny path answers a request the client sent, so it is subject to the
+    # same client and redirect URI validation as #create: without it an
+    # unregistered redirect_uri was honoured and the user-agent redirected to
+    # it, carrying the OAuth `state` to an origin of the caller's choosing.
     def destroy
+      return if refuse_invalid_client?
+
       redirect_or_render(authorization.deny)
     rescue Doorkeeper::Errors::InvalidTokenStrategy => e
       error_response = get_error_response_from_exception(e)
@@ -45,13 +51,37 @@ module Doorkeeper
 
       if Doorkeeper.configuration.redirect_on_errors? && pre_auth.error_response.redirectable?
         redirect_or_render(pre_auth.error_response)
-      elsif Doorkeeper.configuration.api_only
-        render json: pre_auth.error_response.body, status: pre_auth.error_response.status
       else
-        render :error, locals: { error_response: pre_auth.error_response }, status: pre_auth.error_response.status
+        render_error_response(pre_auth.error_response)
       end
     end
 
+    def render_error_response(error_response)
+      if Doorkeeper.configuration.api_only
+        render json: error_response.body, status: error_response.status
+      else
+        render :error, locals: { error_response: error_response }, status: error_response.status
+      end
+    end
+
+    # Renders the error when the request's client_id or redirect_uri is missing
+    # or invalid, and answers whether the request was refused. Errors are
+    # rendered, never redirected, regardless of `handle_auth_errors :redirect`:
+    # no failure this check can produce leaves a redirect target worth
+    # trusting. Either the client failed first, so the redirect URI was never
+    # reached, or the redirect URI is itself the invalid one - and RFC 6749
+    # Section 3.1.2.4 forbids redirecting the user-agent to an invalid
+    # redirection URI.
+    def refuse_invalid_client?
+      return false if pre_auth.client_valid?
+
+      error_response = pre_auth.error_response
+      error_response.raise_exception! if Doorkeeper.config.raise_on_errors?
+
+      render_error_response(error_response)
+      true
+    end
+
     def can_authorize_response?
       Doorkeeper.config.custom_access_token_attributes.empty? && pre_auth.client.application.confidential? && matching_token?
     end

data/app/controllers/doorkeeper/authorized_applications_controller.rb

@@ -3,6 +3,7 @@
 module Doorkeeper
   class AuthorizedApplicationsController < Doorkeeper::ApplicationController
     before_action :authenticate_resource_owner!
+    before_action :validate_resource_owner
 
     def index
       @applications = Doorkeeper.config.application_model.authorized_for(current_resource_owner)
@@ -29,5 +30,27 @@ module Doorkeeper
         format.json { head :no_content }
       end
     end
+
+    private
+
+    # `authenticate_resource_owner!` hands the request to the host
+    # application's `resource_owner_authenticator` block, which is expected to
+    # halt the request itself — redirect to a sign-in page, raise, render —
+    # when nobody is signed in. A block that merely answers nil halts nothing:
+    # the library default (no block configured) logs a warning and answers
+    # nil, and so does any block written as a bare lookup such as
+    # `User.find_by(id: session[:user_id])`.
+    #
+    # Both actions here scope their work to `current_resource_owner`, and a
+    # nil owner is not "no scope" — it is the scope of the records that have
+    # no resource owner, which is what the client credentials flow issues.
+    # #index would list every application holding one and #destroy would
+    # revoke them, for a caller that never authenticated. So refuse the
+    # request rather than treat "nobody" as an owner. Only this controller is
+    # guarded; `authenticate_resource_owner!` itself is left alone because
+    # AuthorizationsController shapes its own response around the owner.
+    def validate_resource_owner
+      head :unauthorized unless current_resource_owner
+    end
   end
 end

data/lib/doorkeeper/config.rb

@@ -329,7 +329,9 @@ module Doorkeeper
     option :allow_grant_flow_for_client,    default: ->(_grant_flow, _client) { true }
 
     # Allows to forbid specific Application redirect URI's by custom rules.
-    # Doesn't forbid any URI by default.
+    # Doesn't forbid any URI by default. Redirect URIs with a script scheme
+    # (`javascript`, `vbscript`, `data`) are always rejected, regardless of
+    # this option.
     #
     # @param forbid_redirect_uri [Proc] Block or any object respond to #call
     #

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -6,6 +6,15 @@ module Doorkeeper
   module OAuth
     module Helpers
       module URIChecker
+        # Schemes a user agent evaluates in the document that navigates to
+        # them instead of fetching a resource from somewhere else. With
+        # `response_mode=form_post` that document is the authorization
+        # server's own page, so a redirect URI with one of these schemes would
+        # run the client's script on the server's origin. None of them can be
+        # a legitimate redirection endpoint (RFC 6749 Section 3.1.2), so they
+        # are refused regardless of the `forbid_redirect_uri` configuration.
+        SCRIPT_SCHEMES = %w[javascript vbscript data].freeze
+
         def self.valid?(url)
           return true if oob_uri?(url)
 
@@ -62,10 +71,15 @@ module Doorkeeper
 
         def self.valid_scheme?(uri)
           return false if uri.scheme.blank?
+          return false if script_scheme?(uri)
 
           %w[localhost].exclude?(uri.scheme)
         end
 
+        def self.script_scheme?(uri)
+          SCRIPT_SCHEMES.include?(uri.scheme.to_s.downcase)
+        end
+
         def self.hypertext_scheme?(uri)
           %w[http https].include?(uri.scheme)
         end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -5,6 +5,14 @@ module Doorkeeper
     class PreAuthorization
       include Validations
 
+      # The validations that identify the client and its redirect URI. None of
+      # them depend on the resource owner, and none of their failures leaves a
+      # redirect target worth trusting: RFC 6749 Section 4.1.2.1 (Section
+      # 4.2.2.1 for the implicit flow) asks for the resource owner to be
+      # informed when the client_id is missing or invalid, and Section 3.1.2.4
+      # asks the same for the redirect URI.
+      CLIENT_VALIDATIONS = %i[client_id client redirect_uri].freeze
+
       validate :client_id, error: Errors::InvalidRequest
       validate :client, error: Errors::InvalidClient
       validate :client_supports_grant_flow, error: Errors::UnauthorizedClient
@@ -40,6 +48,25 @@ module Doorkeeper
         valid?
       end
 
+      # Runs only CLIENT_VALIDATIONS, in declared order, so a request naming an
+      # unknown client or an invalid redirect URI can be refused on its own -
+      # the validations in between (client_supports_grant_flow,
+      # resource_owner_authorize_for_client) answer a different question and
+      # are left to a full #validate run.
+      def client_valid?
+        @error = nil
+        @missing_param = nil
+
+        self.class.validations.each do |validation|
+          next unless CLIENT_VALIDATIONS.include?(validation[:attribute])
+
+          @error = validation[:options][:error] unless send("validate_#{validation[:attribute]}")
+          break if @error
+        end
+
+        @error.nil?
+      end
+
       def scopes
         Scopes.from_string(scope)
       end

data/lib/doorkeeper/oauth/token.rb

@@ -69,11 +69,11 @@ module Doorkeeper
         end
 
         def from_access_token_param(request)
-          request.parameters[:access_token]
+          parameters(request)[:access_token]
         end
 
         def from_bearer_param(request)
-          request.parameters[:bearer_token]
+          parameters(request)[:bearer_token]
         end
 
         def from_bearer_authorization(request)
@@ -114,12 +114,29 @@ module Doorkeeper
           return [] unless request.respond_to?(:GET) && request.respond_to?(:POST)
 
           query = request.GET
-          body = request.POST
+          body = body_parameters(request)
           return [] unless query.is_a?(Hash) && body.is_a?(Hash)
 
           [query[parameter], body[parameter]].filter_map(&:presence)
         end
 
+        # A body ActionDispatch cannot parse — malformed JSON under a JSON
+        # content type, say — carries no token. Reading it must not raise out
+        # of the extractors, which host apps call from places that run after
+        # their own ParseError handling (instrumentation, exception apps), the
+        # same way ActionDispatch's own #filtered_parameters treats that error.
+        def parameters(request)
+          request.parameters
+        rescue ActionDispatch::Http::Parameters::ParseError
+          {}
+        end
+
+        def body_parameters(request)
+          request.POST
+        rescue ActionDispatch::Http::Parameters::ParseError
+          {}
+        end
+
         def token_from_basic_header(header, pattern)
           encoded_header = token_from_header(header, pattern)
           decode_basic_credentials_token(encoded_header)

data/lib/doorkeeper/orm/active_record/redirect_uri_validator.rb

@@ -34,8 +34,12 @@ module Doorkeeper
       Doorkeeper::OAuth::NonStandard::IETF_WG_OAUTH2_OOB_METHODS.include?(uri)
     end
 
+    # Script schemes are refused before the host application's rule is
+    # consulted, so a `forbid_redirect_uri` that rejects them too does not
+    # report the error twice.
     def forbidden_uri?(uri)
-      Doorkeeper.config.forbid_redirect_uri.call(uri)
+      Doorkeeper::OAuth::Helpers::URIChecker.script_scheme?(uri) ||
+        Doorkeeper.config.forbid_redirect_uri.call(uri)
     end
 
     def unspecified_scheme?(uri)

data/lib/doorkeeper/request.rb

@@ -3,18 +3,30 @@
 module Doorkeeper
   module Request
     class << self
+      # Resolves the strategy that answers the given response_type at the
+      # authorization endpoint.
+      #
+      # A response_type no registered authorization flow handles is refused
+      # rather than turned into a class name: `constantize` would otherwise
+      # resolve any constant under Doorkeeper::Request, token endpoint
+      # strategies (`password`, `client_credentials`, `refresh_token`,
+      # `authorization_code`) included, none of which can answer an
+      # authorization request.
       def authorization_strategy(response_type)
+        response_type = response_type.to_s
+
         grant_flow = authorization_flows.detect do |flow|
           flow.matches_response_type?(response_type)
         end
 
-        if grant_flow
-          grant_flow.response_type_strategy
-        else
-          # [NOTE]: this will be removed in a newer versions of Doorkeeper.
-          # For retro-compatibility only
-          build_fallback_strategy_class(response_type)
-        end
+        raise Errors::InvalidTokenStrategy unless grant_flow
+
+        # [NOTE]: this will be removed in a newer versions of Doorkeeper.
+        # For retro-compatibility only: flows declared through the deprecated
+        # Config#calculate_authorization_response_types hook are built as
+        # GrantFlow::FallbackFlow and carry no strategy, so the class is looked
+        # up by name - but only for a response type the server does declare.
+        grant_flow.response_type_strategy || build_fallback_strategy_class(response_type)
       end
 
       def token_strategy(grant_type)

data/lib/doorkeeper/version.rb

@@ -5,7 +5,7 @@ module Doorkeeper
     # Semantic versioning
     MAJOR = 5
     MINOR = 9
-    TINY = 7
+    TINY = 9
     PRE = nil
 
     # Full version number

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -316,10 +316,13 @@ Doorkeeper.configure do
   # Specify what redirect URI's you want to block during Application creation.
   # Any redirect URI is allowed by default.
   #
-  # You can use this option in order to forbid URI's with 'javascript' scheme
+  # Redirect URIs with a script scheme (`javascript`, `vbscript`, `data`) are
+  # always rejected, regardless of this option.
+  #
+  # You can use this option in order to forbid URI's of a particular host
   # for example.
   #
-  # forbid_redirect_uri { |uri| uri.scheme.to_s.downcase == 'javascript' }
+  # forbid_redirect_uri { |uri| uri.host == 'example.com' }
 
   # Allows to set blank redirect URIs for Applications in case Doorkeeper configured
   # to use URI-less OAuth grant flows like Client Credentials or Resource Owner

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.9.7
+  version: 5.9.9
 platform: ruby
 authors:
 - Felipe Elias Philipp
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-09-10 00:00:00.000000000 Z
+date: 2026-09-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties