soajs.controller 4.2.36 → 4.2.37

package/lib/header.js

@@ -0,0 +1,51 @@
+"use strict";
+
+/**
+ * @license
+ * Copyright SOAJS All Rights Reserved.
+ *
+ * Use of this source code is governed by an Apache license that can be
+ * found in the LICENSE file at the root of this repository
+ */
+
+
+/**
+ * Encodes a string to be safely used as an HTTP header value.
+ * This preserves all data and is the standard, recommended method.
+ *
+ * @param {string | number | boolean} value The value to encode.
+ * @returns {string} The URL-encoded string.
+ */
+function encodeHeaderValue(value) {
+    if (value === null || typeof value === 'undefined') {
+        return '';
+    }
+    return encodeURIComponent(String(value));
+}
+
+/**
+ * Decodes a URL-encoded string from an HTTP header.
+ * It safely handles potential errors if the input is malformed.
+ *
+ * @param {string} encodedValue The percent-encoded header value to decode.
+ * @returns {string} The decoded (original) string, or the original
+ * string if decoding fails.
+ */
+function decodeHeaderValue(encodedValue) {
+    // Return empty string or null as is, to avoid errors.
+    if (!encodedValue) {
+        return encodedValue;
+    }
+
+    try {
+        // The standard way to decode a value encoded by encodeURIComponent.
+        return decodeURIComponent(encodedValue);
+    } catch (e) {
+        // This catches errors from malformed URI sequences (e.g., a lone '%').
+        console.error(`Failed to decode header value: "${encodedValue}"`, e);
+        // Return the original, undecoded value so the app doesn't crash.
+        return encodedValue;
+    }
+}
+
+module.exports = { encodeHeaderValue, decodeHeaderValue };

package/mw/mt/index.js

@@ -12,6 +12,9 @@ const async = require("async");
 
 const utils = require("./utils");
 
+
+const { encodeHeaderValue } = require("../../lib/header.js");
+
 /**
  *
  * @param configuration
@@ -247,8 +250,8 @@ module.exports = (configuration) => {
 												injectObj.urac = {
 													"_id": uracObj._id,
 													"username": uracObj.username,
-													"firstName": uracObj.firstName,
-													"lastName": uracObj.lastName,
+													"firstName": encodeHeaderValue(uracObj.firstName),
+													"lastName": encodeHeaderValue(uracObj.lastName),
 													"email": uracObj.email,
 													"groups": uracObj.groups,
 													"socialLogin": uracObj.socialLogin,
@@ -336,12 +339,14 @@ module.exports = (configuration) => {
 													req.soajs.log.error(err.message);
 												}
 												let _h = JSON.stringify(injectObj);
-												req.headers.soajsinjectobj = Buffer.from(_h, 'ascii').toString('utf-8');
+												// req.headers.soajsinjectobj = Buffer.from(_h, 'ascii').toString('utf-8');
+												req.headers.soajsinjectobj = _h; //encodeHeaderValue(_h);
 												return next();
 											});
 									} else {
 										let _h = JSON.stringify(injectObj);
-										req.headers.soajsinjectobj = Buffer.from(_h, 'ascii').toString('utf-8');
+										// req.headers.soajsinjectobj = Buffer.from(_h, 'ascii').toString('utf-8');
+										req.headers.soajsinjectobj = _h; //encodeHeaderValue(_h);
 										return next();
 									}
 								}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "soajs.controller",
   "description": "soajs multi tenant API gateway",
-  "version": "4.2.36",
+  "version": "4.2.37",
   "author": {
     "name": "soajs team",
     "email": "team@soajs.org"

package/test/data/provision/marketplace/httpmethods.js

@@ -27,7 +27,7 @@ let service = {
 		},
 		oauth: true,
 		extKeyRequired: true,
-		urac: false,
+		urac: true,
 		urac_Profile: false,
 		urac_ACL: false,
 		provision_ACL: false,

package/test/data/provision/oauth/token/access_token.js

@@ -9,7 +9,7 @@ let token = {
         _id: "5c8d0c505653de3985aa0ffd",
         locked: true,
         username: "owner",
-        firstName: "owner3",
+        firstName: "owner3'sèį",
         lastName: "owner",
         email: "me@localhost.com",
         "ts": new Date().getTime(),

package/test/data/provision/oauth/token/refresh_token.js

@@ -9,7 +9,7 @@ let token = {
         _id: "5c8d0c505653de3985aa0ffd",
         locked: true,
         username: "owner",
-        firstName: "owner3",
+        firstName: "owner3'sèį",
         lastName: "owner",
         email: "me@localhost.com",
         "ts": new Date().getTime(),

package/test/data/provision/urac/users/owner.js

@@ -4,7 +4,7 @@ let user = {
     locked: true,
     username: "owner",
     password: "$2a$12$geJJfv33wkYIXEAlDkeeuOgiQ6y6MjP/YxbqLdHdDSK7LDG.7n7Pq",
-    firstName: "owner3",
+    firstName: "owner3'sèį",
     lastName: "owner",
     email: "me@localhost.com",
     ts: 1552747600152,

package/test/integration/UC1-gateway-routes/oauth-service-mock.js

@@ -20,15 +20,17 @@ function startServer(serverConfig, callback) {
 			'lastname': "hage"
 		}
 	};
-	
-	
-	sApp.get('/passport/login', (req, res) => res.json(sReply));
-	
+
+
+	sApp.get('/passport/login', (req, res) => {
+		res.json(sReply);
+	});
+
 	mApp.get('/heartbeat', (req, res) => res.json(mReply));
-	
+
 	let sAppServer = sApp.listen(serverConfig.s.port, () => console.log(`${serverConfig.name} service mock listening on port ${serverConfig.s.port}!`));
 	let mAppServer = mApp.listen(serverConfig.m.port, () => console.log(`${serverConfig.name} service mock listening on port ${serverConfig.m.port}!`));
-	
+
 	return callback(
 		{
 			"sAppServer": sAppServer,
@@ -40,11 +42,11 @@ function startServer(serverConfig, callback) {
 
 function killServer(config) {
 	console.log("killing server ....");
-	
+
 	config.mAppServer.close((err) => {
 		console.log("...sAppServer: " + config.name);
 	});
-	
+
 	config.sAppServer.close((err) => {
 		console.log("...mAppServer: " + config.name);
 	});

package/test/integration/UC2-http-methods/service-mock/soa.json

@@ -44,7 +44,7 @@
   "requestTimeoutRenewal": 5,
   "extKeyRequired": true,
   "oauth": true,
-  "urac": false,
+  "urac": true,
   "urac_Profile": false,
   "urac_ACL": false,
   "tenant_Profile": false,