mirror of
https://github.com/m1k1o/neko.git
synced 2026-11-03 08:21:50 -06:00
Miroslav Šedivý
23d8a2718e
An unverified email could match admin_emails/user_emails on providers that let users set their own email. Only an explicit false is rejected; providers that omit the claim are still trusted. Document the behavior. Reported-by: Zachariah Mithani <zachariah@aplosai.com> (AploSec)
23 lines
611 B
Go
23 lines
611 B
Go
package oauth
|
|
|
|
import "testing"
|
|
|
|
func TestClaimFalse(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
claims map[string]any
|
|
want bool
|
|
}{
|
|
{"absent", map[string]any{}, false},
|
|
{"true", map[string]any{"email_verified": true}, false},
|
|
{"false", map[string]any{"email_verified": false}, true},
|
|
{"string true", map[string]any{"email_verified": "true"}, false},
|
|
{"string false", map[string]any{"email_verified": "False"}, true},
|
|
}
|
|
for _, tc := range cases {
|
|
if got := claimFalse(tc.claims, "email_verified"); got != tc.want {
|
|
t.Errorf("%s: got %v, want %v", tc.name, got, tc.want)
|
|
}
|
|
}
|
|
}
|