Merge pull request #964 from bomgar/master

Fix NPE in ThreadSafeHMAC when secret is not set

Author: slandelle

api/src/main/java/org/asynchttpclient/oauth/ThreadSafeHMAC.java

@@ -44,7 +44,9 @@ public ThreadSafeHMAC(ConsumerKey consumerAuth, RequestToken userAuth) {
         StringBuilder sb = StringUtils.stringBuilder();
         Utf8UrlEncoder.encodeAndAppendQueryElement(sb, consumerAuth.getSecret());
         sb.append('&');
-        Utf8UrlEncoder.encodeAndAppendQueryElement(sb, userAuth.getSecret());
+        if(userAuth != null && userAuth.getSecret() != null) {
+            Utf8UrlEncoder.encodeAndAppendQueryElement(sb, userAuth.getSecret());
+        }
         byte[] keyBytes = StringUtils.charSequence2Bytes(sb, UTF_8);
         SecretKeySpec signingKey = new SecretKeySpec(keyBytes, HMAC_SHA1_ALGORITHM);
 

api/src/test/java/org/asynchttpclient/oauth/OAuthSignatureCalculatorTest.java

@@ -297,4 +297,33 @@ public void testGetWithRequestBuilderAndQuery() {
         assertEquals(sig, "tR3+Ty81lMeYAr/Fid0kMTYa/WM=");
         assertEquals(req.getUrl(), "http://photos.example.net/photos?file=vacation.jpg&size=original");
     }
+
+    @Test(groups = "fast")
+    public void testWithNullRequestToken() {
+      String url = "http://photos.example.net/photos?file=vacation.jpg&size=original";
+      ConsumerKey consumer = new ConsumerKey("9djdj82h48djs9d2", CONSUMER_SECRET);
+      RequestToken user = new RequestToken(null, null);
+      OAuthSignatureCalculator calc = new OAuthSignatureCalculator(consumer, user);
+
+      final Request request = new RequestBuilder("GET")//
+          .setUri(Uri.create(url))//
+          .setSignatureCalculator(calc)//
+          .build();
+
+      String signatureBaseString = calc.signatureBaseString(//
+          request.getMethod(),//
+          request.getUri(),//
+          137131201,//
+          "ZLc92RAkooZcIO/0cctl0Q==",//
+          request.getFormParams(),//
+          request.getQueryParams()).toString();
+
+      assertEquals(signatureBaseString, "GET&" + //
+          "http%3A%2F%2Fphotos.example.net%2Fphotos&file%3Dvacation.jpg%26" + //
+          "oauth_consumer_key%3D9djdj82h48djs9d2%26" + //
+          "oauth_nonce%3DZLc92RAkooZcIO%252F0cctl0Q%253D%253D%26" + //
+          "oauth_signature_method%3DHMAC-SHA1%26" + //
+          "oauth_timestamp%3D137131201%26" + //
+          "oauth_version%3D1.0%26size%3Doriginal");
+    }
 }