OAuth Authorization Code Parameter Not URL-Encoded in Token Exchange Request #88

Issue: FINDING-067 - OAuth Authorization Code Parameter Not URL-Encoded in Token Exchange Request

Labels: bug, security, priority:medium, asvs-level:L1, asvs-level:L2

ASVS Level(s): [L1, L2]

Description:

Summary

The OAuth authorization code parameter is not URL-encoded before being interpolated into the token exchange request URL to oauth.apache.org. While urllib.parse.quote() is imported and used extensively in the same file for other OAuth parameters, it is not applied to the 'code' parameter. This allows an attacker to inject additional query parameters into the token exchange request. Per RFC 6749 §4.1.2, authorization codes can contain any printable ASCII character including &, =, ?, and #, which enables parameter injection attacks.

Details

Affected Files and Lines:

• src/asfquart/generics.py:97 - Code parameter without URL encoding

The authorization code is interpolated directly into the URL without encoding, allowing special characters to inject additional parameters.

Recommended Remediation

Apply urllib.parse.quote() to the OAuth code parameter before URL interpolation:

encoded_code = urllib.parse.quote(code, safe='')
rv = await session.get(OAUTH_URL_CALLBACK % encoded_code)

Additionally, consider using create_secure_session() from atr/util.py instead of plain aiohttp.ClientSession to enforce TLS 1.2+, explicit certificate verification, hostname checking, and secure cipher suite selection for defense-in-depth.

Acceptance Criteria

• Code parameter URL-encoded
• Parameter injection prevented
• Hardened TLS session considered
• Integration test verifies encoding
• Unit test verifying the fix

References

• Source reports: L1:1.2.2.md, L2:1.3.6.md
• Related findings: FINDING-068
• ASVS sections: 1.2.2, 1.3.6

Priority

Medium