Percent-encode key when building OAuth1 header, close AsyncHttpClient#1415

Author: slandelle

client/src/main/java/org/asynchttpclient/oauth/ConsumerKey.java

@@ -16,16 +16,20 @@
  */
 package org.asynchttpclient.oauth;
 
+import org.asynchttpclient.util.Utf8UrlEncoder;
+
 /**
  * Value class for OAuth consumer keys.
  */
 public class ConsumerKey {
     private final String key;
     private final String secret;
+    private final String percentEncodedKey;
 
     public ConsumerKey(String key, String secret) {
         this.key = key;
         this.secret = secret;
+        this.percentEncodedKey = Utf8UrlEncoder.percentEncodeQueryElement(key);
     }
 
     public String getKey() {
@@ -36,6 +40,10 @@ public String getSecret() {
         return secret;
     }
 
+    String getPercentEncodedKey() {
+        return percentEncodedKey;
+    }
+
     @Override
     public String toString() {
         StringBuilder sb = new StringBuilder("{Consumer key, key=");

client/src/main/java/org/asynchttpclient/oauth/OAuthSignatureCalculatorInstance.java

@@ -123,11 +123,11 @@ private String encodedParams(ConsumerKey consumerAuth, RequestToken userAuth, lo
          * List of all query and form parameters added to this request; needed for calculating request signature
          */
         // start with standard OAuth parameters we need
-        parameters.add(KEY_OAUTH_CONSUMER_KEY, Utf8UrlEncoder.percentEncodeQueryElement(consumerAuth.getKey()))
+        parameters.add(KEY_OAUTH_CONSUMER_KEY, consumerAuth.getPercentEncodedKey())
                 .add(KEY_OAUTH_NONCE, Utf8UrlEncoder.percentEncodeQueryElement(nonce)).add(KEY_OAUTH_SIGNATURE_METHOD, OAUTH_SIGNATURE_METHOD)
                 .add(KEY_OAUTH_TIMESTAMP, String.valueOf(oauthTimestamp));
         if (userAuth.getKey() != null) {
-            parameters.add(KEY_OAUTH_TOKEN, Utf8UrlEncoder.percentEncodeQueryElement(userAuth.getKey()));
+            parameters.add(KEY_OAUTH_TOKEN, userAuth.getPercentEncodedKey());
         }
         parameters.add(KEY_OAUTH_VERSION, OAUTH_VERSION_1_0);
 
@@ -173,9 +173,9 @@ private byte[] digest(ConsumerKey consumerAuth, RequestToken userAuth, ByteBuffe
     String constructAuthHeader(ConsumerKey consumerAuth, RequestToken userAuth, String signature, String nonce, long oauthTimestamp) {
         StringBuilder sb = StringBuilderPool.DEFAULT.stringBuilder();
         sb.append("OAuth ");
-        sb.append(KEY_OAUTH_CONSUMER_KEY).append("=\"").append(consumerAuth.getKey()).append("\", ");
+        sb.append(KEY_OAUTH_CONSUMER_KEY).append("=\"").append(consumerAuth.getPercentEncodedKey()).append("\", ");
         if (userAuth.getKey() != null) {
-            sb.append(KEY_OAUTH_TOKEN).append("=\"").append(userAuth.getKey()).append("\", ");
+            sb.append(KEY_OAUTH_TOKEN).append("=\"").append(userAuth.getPercentEncodedKey()).append("\", ");
         }
         sb.append(KEY_OAUTH_SIGNATURE_METHOD).append("=\"").append(OAUTH_SIGNATURE_METHOD).append("\", ");
 

client/src/main/java/org/asynchttpclient/oauth/RequestToken.java

@@ -16,6 +16,8 @@
  */
 package org.asynchttpclient.oauth;
 
+import org.asynchttpclient.util.Utf8UrlEncoder;
+
 /**
  * Value class used for OAuth tokens (request secret, access secret);
  * simple container with two parts, public id part ("key") and
@@ -24,10 +26,12 @@
 public class RequestToken {
     private final String key;
     private final String secret;
+    private final String percentEncodedKey;
 
     public RequestToken(String key, String token) {
         this.key = key;
         this.secret = token;
+        this.percentEncodedKey = Utf8UrlEncoder.percentEncodeQueryElement(key);
     }
 
     public String getKey() {
@@ -38,6 +42,10 @@ public String getSecret() {
         return secret;
     }
 
+    String getPercentEncodedKey() {
+        return percentEncodedKey;
+    }
+
     @Override
     public String toString() {
         StringBuilder sb = new StringBuilder("{ key=");

client/src/main/java/org/asynchttpclient/util/Utf8UrlEncoder.java

@@ -143,6 +143,9 @@ public static StringBuilder encodeAndAppendFormElement(StringBuilder sb, CharSeq
     }
 
     public static String percentEncodeQueryElement(String input) {
+        if (input == null) {
+            return null;
+        }
         StringBuilder sb = new StringBuilder(input.length() + 6);
         encodeAndAppendPercentEncoded(sb, input);
         return sb.toString();

client/src/test/java/org/asynchttpclient/oauth/OAuthSignatureCalculatorTest.java

@@ -27,6 +27,7 @@
 
 import org.asynchttpclient.Param;
 import org.asynchttpclient.Request;
+import org.asynchttpclient.RequestBuilder;
 import org.testng.annotations.Test;
 
 /**
@@ -312,4 +313,20 @@ public void testSignatureGenerationWithAsteriskInPath() throws InvalidKeyExcepti
         String generatedAuthHeader = new OAuthSignatureCalculatorInstance().constructAuthHeader(consumerKey, requestToken, actualSignature, nonce, timestamp);
         assertTrue(generatedAuthHeader.contains("oauth_signature=\"cswi%2Fv3ZqhVkTyy5MGqW841BxDA%3D\""));
     }
+
+    @Test
+    public void testPercentEncodeKeyValues() throws NoSuchAlgorithmException {
+        // see https://github.com/AsyncHttpClient/async-http-client/issues/1415
+        String keyValue = "\u3b05\u000c\u375b";
+
+        ConsumerKey consumer = new ConsumerKey(keyValue, "secret");
+        RequestToken reqToken = new RequestToken(keyValue, "secret");
+        OAuthSignatureCalculator calc = new OAuthSignatureCalculator(consumer, reqToken);
+
+        RequestBuilder reqBuilder = new RequestBuilder()
+                .setUrl("https://api.dropbox.com/1/oauth/access_token?oauth_token=%EC%AD%AE%E3%AC%82%EC%BE%B8%E7%9C%9A%E8%BD%BD%E1%94%A5%E8%AD%AF%E8%98%93%E0%B9%99%E5%9E%96%EF%92%A2%EA%BC%97%EA%90%B0%E4%8A%91%E8%97%BF%EF%A8%BB%E5%B5%B1%DA%98%E2%90%87%E2%96%96%EE%B5%B5%E7%B9%AD%E9%AD%87%E3%BE%93%E5%AF%92%EE%BC%8F%E3%A0%B2%E8%A9%AB%E1%8B%97%EC%BF%80%EA%8F%AE%ED%87%B0%E5%97%B7%E9%97%BF%E8%BF%87%E6%81%A3%E5%BB%A1%EC%86%92%E8%92%81%E2%B9%94%EB%B6%86%E9%AE%8A%E6%94%B0%EE%AC%B5%E6%A0%99%EB%8B%AD%EB%BA%81%E7%89%9F%E5%B3%B7%EA%9D%B7%EC%A4%9C%E0%BC%BA%EB%BB%B9%ED%84%A9%E8%A5%B9%E8%AF%A0%E3%AC%85%0C%E3%9D%9B%E8%B9%8B%E6%BF%8C%EB%91%98%E7%8B%B3%E7%BB%A8%E2%A7%BB%E6%A3%84%E1%AB%B2%E8%8D%93%E4%BF%98%E9%B9%B9%EF%9A%8B%E8%A5%93");
+        Request req = reqBuilder.build();
+
+        calc.calculateAndAddSignature(req, reqBuilder);
+    }
 }