From 1f706e1df3465af27443e8e6969ca04e59c6060a Mon Sep 17 00:00:00 2001 From: zzhuang Date: Thu, 25 Apr 2024 02:48:23 -0400 Subject: [PATCH] fix: SteamOpenId does not validate identity url (#807) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix: SteamOpenId does not validate identity url * Fix failing test * Fix referencing self --------- Co-authored-by: async42 Co-authored-by: Michal Čihař --- social_core/backends/steam.py | 2 ++ social_core/tests/backends/test_steam.py | 30 ++++++++++++++++++++++++ 2 files changed, 32 insertions(+) diff --git a/social_core/backends/steam.py b/social_core/backends/steam.py index 0a4177335..bfd37d5e7 100644 --- a/social_core/backends/steam.py +++ b/social_core/backends/steam.py @@ -46,6 +46,8 @@ def consumer(self): return self._consumer def _user_id(self, response): + if not response.identity_url.startswith(self.URL): + raise AuthFailed(self, "Openid identifier mismatch") user_id = response.identity_url.rsplit("/", 1)[-1] if not user_id.isdigit(): raise AuthFailed(self, "Missing Steam Id") diff --git a/social_core/tests/backends/test_steam.py b/social_core/tests/backends/test_steam.py index d0e31cbd7..6798e453c 100644 --- a/social_core/tests/backends/test_steam.py +++ b/social_core/tests/backends/test_steam.py @@ -140,3 +140,33 @@ def test_partial_pipeline(self): self._login_setup(user_url="https://steamcommunity.com/openid/BROKEN") with self.assertRaises(AuthFailed): self.do_partial_pipeline() + + +class SteamOpenIdFakeSteamIdTest(SteamOpenIdTest): + server_response = urlencode( + { + "janrain_nonce": JANRAIN_NONCE, + "openid.ns": "http://specs.openid.net/auth/2.0", + "openid.mode": "id_res", + "openid.op_endpoint": "https://steamcommunity.com/openid/login", + "openid.claimed_id": "https://fakesteamcommunity.com/openid/123", + "openid.identity": "https://fakesteamcommunity.com/openid/123", + "openid.return_to": "http://myapp.com/complete/steam/?" + "janrain_nonce=" + JANRAIN_NONCE, + "openid.response_nonce": JANRAIN_NONCE + "oD4UZ3w9chOAiQXk0AqDipqFYRA=", + "openid.assoc_handle": "1234567890", + "openid.signed": "signed,op_endpoint,claimed_id,identity,return_to," + "response_nonce,assoc_handle", + "openid.sig": "1az53vj9SVdiBwhk8%2BFQ68R2plo=", + } + ) + + def test_login(self): + self._login_setup(user_url="https://fakesteamcommunity.com/openid/123") + with self.assertRaises(AuthFailed): + self.do_login() + + def test_partial_pipeline(self): + self._login_setup(user_url="https://fakesteamcommunity.com/openid/123") + with self.assertRaises(AuthFailed): + self.do_partial_pipeline()