{"action":"created","comment":{"url":"https://api.github.com/repos/yohcop/openid-go/pulls/comments/49959859","id":49959859,"diff_hunk":"@@ -30,3 +30,56 @@ func TestVerifyNonce(t *testing.T) {\n \t\tt.Errorf(\"verifyNonce failed unexpectedly: %v\", err)\n \t}\n }\n+\n+func TestVerifySignedFields(t *testing.T) {\n+\tv := url.Values{}\n+\n+\t// Everything properly signed\n+\tv.Set(\"openid.signed\", \"signed,op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle\")\n+\tif err := verifySignedFields(v); err != nil {\n+\t\tt.Errorf(\"verifySignedFields failed unexpectedly: %v\", err)\n+\t}\n+\n+\t// No claimed_id/identity\n+\tv.Set(\"openid.signed\", \"signed,op_endpoint,return_to,response_nonce,assoc_handle\")\n+\tif err := verifySignedFields(v); err != nil {\n+\t\tt.Errorf(\"verifySignedFields failed unexpectedly: %v\", err)\n+\t}\n+\n+\t// With claimed_id/identity, but not signed\n+\tv.Set(\"openid.claimed_id\", \"foo\")\n+\tv.Set(\"openid.identity\", \"foo\")","path":"verify_test.go","position":22,"original_position":22,"commit_id":"54446dc86cc67a8f15763c28009db02cefcbf55f","original_commit_id":"54446dc86cc67a8f15763c28009db02cefcbf55f","user":{"login":"yohcop","id":455541,"avatar_url":"https://avatars.githubusercontent.com/u/455541?v=3","gravatar_id":"","url":"https://api.github.com/users/yohcop","html_url":"https://github.com/yohcop","followers_url":"https://api.github.com/users/yohcop/followers","following_url":"https://api.github.com/users/yohcop/following{/other_user}","gists_url":"https://api.github.com/users/yohcop/gists{/gist_id}","starred_url":"https://api.github.com/users/yohcop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yohcop/subscriptions","organizations_url":"https://api.github.com/users/yohcop/orgs","repos_url":"https://api.github.com/users/yohcop/repos","events_url":"https://api.github.com/users/yohcop/events{/privacy}","received_events_url":"https://api.github.com/users/yohcop/received_events","type":"User","site_admin":false},"body":"I think it's risky that those tests reuse the same url.Values{} instance. You override stuff as you go, but for a test to be complete, one have to read all the above ones as well. Table-based tests would solve that, at the cost of having to repeat some key/values.","created_at":"2016-01-18T03:31:11Z","updated_at":"2016-01-18T03:31:11Z","html_url":"https://github.com/yohcop/openid-go/pull/26#discussion_r49959859","pull_request_url":"https://api.github.com/repos/yohcop/openid-go/pulls/26","_links":{"self":{"href":"https://api.github.com/repos/yohcop/openid-go/pulls/comments/49959859"},"html":{"href":"https://github.com/yohcop/openid-go/pull/26#discussion_r49959859"},"pull_request":{"href":"https://api.github.com/repos/yohcop/openid-go/pulls/26"}}},"pull_request":{"url":"https://api.github.com/repos/yohcop/openid-go/pulls/26","id":56296761,"html_url":"https://github.com/yohcop/openid-go/pull/26","diff_url":"https://github.com/yohcop/openid-go/pull/26.diff","patch_url":"https://github.com/yohcop/openid-go/pull/26.patch","issue_url":"https://api.github.com/repos/yohcop/openid-go/issues/26","number":26,"state":"open","locked":false,"title":"Properly check if all the required fields have been signed","user":{"login":"xStrom","id":754881,"avatar_url":"https://avatars.githubusercontent.com/u/754881?v=3","gravatar_id":"","url":"https://api.github.com/users/xStrom","html_url":"https://github.com/xStrom","followers_url":"https://api.github.com/users/xStrom/followers","following_url":"https://api.github.com/users/xStrom/following{/other_user}","gists_url":"https://api.github.com/users/xStrom/gists{/gist_id}","starred_url":"https://api.github.com/users/xStrom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xStrom/subscriptions","organizations_url":"https://api.github.com/users/xStrom/orgs","repos_url":"https://api.github.com/users/xStrom/repos","events_url":"https://api.github.com/users/xStrom/events{/privacy}","received_events_url":"https://api.github.com/users/xStrom/received_events","type":"User","site_admin":false},"body":"The [OpenID 2.0 spec point 10.1](http://openid.net/specs/openid-authentication-2_0.html#positive_assertions) states that \"*[openid.signed] MUST contain at least \"op_endpoint\", \"return_to\" \"response_nonce\" and \"assoc_handle\", and if present in the response, \"claimed_id\" and \"identity\".*\"\r\n\r\nCurrently the code doesn't verify any of this. This patch implements this verification.\r\n\r\nThis is a **high level security vulnerability**.\r\n\r\nOne attack scenario being where the attacker acquires a legitimate positive assertion without the `claimed_id` field. Then intercepting the browser redirect to the callback and adding their own malicious `claimed_id` field. All verifications pass and the malicious `claimed_id` is treated as verified.\r\n\r\nI wrote a crude proof of concept exploit for this and tested it on the Steam OpenID Authentication server. Steam happily confirmed my `check_authentication` request because all the signed fields were legitimate and the nonce was new & unused. Steam had access to my malicious parameters (because they are sent as part of the spec requirement), but because the spec doesn't seem to require the OP to look for such attacks, ignored them.","created_at":"2016-01-18T02:42:26Z","updated_at":"2016-01-18T03:31:11Z","closed_at":null,"merged_at":null,"merge_commit_sha":"17c9683e070409508f0fc433113ba5e329cbe90e","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/yohcop/openid-go/pulls/26/commits","review_comments_url":"https://api.github.com/repos/yohcop/openid-go/pulls/26/comments","review_comment_url":"https://api.github.com/repos/yohcop/openid-go/pulls/comments{/number}","comments_url":"https://api.github.com/repos/yohcop/openid-go/issues/26/comments","statuses_url":"https://api.github.com/repos/yohcop/openid-go/statuses/54446dc86cc67a8f15763c28009db02cefcbf55f","head":{"label":"xStrom:verifySig","ref":"verifySig","sha":"54446dc86cc67a8f15763c28009db02cefcbf55f","user":{"login":"xStrom","id":754881,"avatar_url":"https://avatars.githubusercontent.com/u/754881?v=3","gravatar_id":"","url":"https://api.github.com/users/xStrom","html_url":"https://github.com/xStrom","followers_url":"https://api.github.com/users/xStrom/followers","following_url":"https://api.github.com/users/xStrom/following{/other_user}","gists_url":"https://api.github.com/users/xStrom/gists{/gist_id}","starred_url":"https://api.github.com/users/xStrom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xStrom/subscriptions","organizations_url":"https://api.github.com/users/xStrom/orgs","repos_url":"https://api.github.com/users/xStrom/repos","events_url":"https://api.github.com/users/xStrom/events{/privacy}","received_events_url":"https://api.github.com/users/xStrom/received_events","type":"User","site_admin":false},"repo":{"id":49795449,"name":"openid-go","full_name":"xStrom/openid-go","owner":{"login":"xStrom","id":754881,"avatar_url":"https://avatars.githubusercontent.com/u/754881?v=3","gravatar_id":"","url":"https://api.github.com/users/xStrom","html_url":"https://github.com/xStrom","followers_url":"https://api.github.com/users/xStrom/followers","following_url":"https://api.github.com/users/xStrom/following{/other_user}","gists_url":"https://api.github.com/users/xStrom/gists{/gist_id}","starred_url":"https://api.github.com/users/xStrom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xStrom/subscriptions","organizations_url":"https://api.github.com/users/xStrom/orgs","repos_url":"https://api.github.com/users/xStrom/repos","events_url":"https://api.github.com/users/xStrom/events{/privacy}","received_events_url":"https://api.github.com/users/xStrom/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/xStrom/openid-go","description":"OpenID consumer implementation in Go - golang","fork":true,"url":"https://api.github.com/repos/xStrom/openid-go","forks_url":"https://api.github.com/repos/xStrom/openid-go/forks","keys_url":"https://api.github.com/repos/xStrom/openid-go/keys{/key_id}","collaborators_url":"https://api.github.com/repos/xStrom/openid-go/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/xStrom/openid-go/teams","hooks_url":"https://api.github.com/repos/xStrom/openid-go/hooks","issue_events_url":"https://api.github.com/repos/xStrom/openid-go/issues/events{/number}","events_url":"https://api.github.com/repos/xStrom/openid-go/events","assignees_url":"https://api.github.com/repos/xStrom/openid-go/assignees{/user}","branches_url":"https://api.github.com/repos/xStrom/openid-go/branches{/branch}","tags_url":"https://api.github.com/repos/xStrom/openid-go/tags","blobs_url":"https://api.github.com/repos/xStrom/openid-go/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/xStrom/openid-go/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/xStrom/openid-go/git/refs{/sha}","trees_url":"https://api.github.com/repos/xStrom/openid-go/git/trees{/sha}","statuses_url":"https://api.github.com/repos/xStrom/openid-go/statuses/{sha}","languages_url":"https://api.github.com/repos/xStrom/openid-go/languages","stargazers_url":"https://api.github.com/repos/xStrom/openid-go/stargazers","contributors_url":"https://api.github.com/repos/xStrom/openid-go/contributors","subscribers_url":"https://api.github.com/repos/xStrom/openid-go/subscribers","subscription_url":"https://api.github.com/repos/xStrom/openid-go/subscription","commits_url":"https://api.github.com/repos/xStrom/openid-go/commits{/sha}","git_commits_url":"https://api.github.com/repos/xStrom/openid-go/git/commits{/sha}","comments_url":"https://api.github.com/repos/xStrom/openid-go/comments{/number}","issue_comment_url":"https://api.github.com/repos/xStrom/openid-go/issues/comments{/number}","contents_url":"https://api.github.com/repos/xStrom/openid-go/contents/{+path}","compare_url":"https://api.github.com/repos/xStrom/openid-go/compare/{base}...{head}","merges_url":"https://api.github.com/repos/xStrom/openid-go/merges","archive_url":"https://api.github.com/repos/xStrom/openid-go/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/xStrom/openid-go/downloads","issues_url":"https://api.github.com/repos/xStrom/openid-go/issues{/number}","pulls_url":"https://api.github.com/repos/xStrom/openid-go/pulls{/number}","milestones_url":"https://api.github.com/repos/xStrom/openid-go/milestones{/number}","notifications_url":"https://api.github.com/repos/xStrom/openid-go/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/xStrom/openid-go/labels{/name}","releases_url":"https://api.github.com/repos/xStrom/openid-go/releases{/id}","created_at":"2016-01-16T23:34:05Z","updated_at":"2016-01-16T23:34:06Z","pushed_at":"2016-01-18T02:51:08Z","git_url":"git://github.com/xStrom/openid-go.git","ssh_url":"git@github.com:xStrom/openid-go.git","clone_url":"https://github.com/xStrom/openid-go.git","svn_url":"https://github.com/xStrom/openid-go","homepage":"","size":67,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"yohcop:master","ref":"master","sha":"d669299cd56d1b7b60454dc448cca9fb974b2bce","user":{"login":"yohcop","id":455541,"avatar_url":"https://avatars.githubusercontent.com/u/455541?v=3","gravatar_id":"","url":"https://api.github.com/users/yohcop","html_url":"https://github.com/yohcop","followers_url":"https://api.github.com/users/yohcop/followers","following_url":"https://api.github.com/users/yohcop/following{/other_user}","gists_url":"https://api.github.com/users/yohcop/gists{/gist_id}","starred_url":"https://api.github.com/users/yohcop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yohcop/subscriptions","organizations_url":"https://api.github.com/users/yohcop/orgs","repos_url":"https://api.github.com/users/yohcop/repos","events_url":"https://api.github.com/users/yohcop/events{/privacy}","received_events_url":"https://api.github.com/users/yohcop/received_events","type":"User","site_admin":false},"repo":{"id":1472997,"name":"openid-go","full_name":"yohcop/openid-go","owner":{"login":"yohcop","id":455541,"avatar_url":"https://avatars.githubusercontent.com/u/455541?v=3","gravatar_id":"","url":"https://api.github.com/users/yohcop","html_url":"https://github.com/yohcop","followers_url":"https://api.github.com/users/yohcop/followers","following_url":"https://api.github.com/users/yohcop/following{/other_user}","gists_url":"https://api.github.com/users/yohcop/gists{/gist_id}","starred_url":"https://api.github.com/users/yohcop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yohcop/subscriptions","organizations_url":"https://api.github.com/users/yohcop/orgs","repos_url":"https://api.github.com/users/yohcop/repos","events_url":"https://api.github.com/users/yohcop/events{/privacy}","received_events_url":"https://api.github.com/users/yohcop/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/yohcop/openid-go","description":"OpenID consumer implementation in Go - golang","fork":false,"url":"https://api.github.com/repos/yohcop/openid-go","forks_url":"https://api.github.com/repos/yohcop/openid-go/forks","keys_url":"https://api.github.com/repos/yohcop/openid-go/keys{/key_id}","collaborators_url":"https://api.github.com/repos/yohcop/openid-go/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/yohcop/openid-go/teams","hooks_url":"https://api.github.com/repos/yohcop/openid-go/hooks","issue_events_url":"https://api.github.com/repos/yohcop/openid-go/issues/events{/number}","events_url":"https://api.github.com/repos/yohcop/openid-go/events","assignees_url":"https://api.github.com/repos/yohcop/openid-go/assignees{/user}","branches_url":"https://api.github.com/repos/yohcop/openid-go/branches{/branch}","tags_url":"https://api.github.com/repos/yohcop/openid-go/tags","blobs_url":"https://api.github.com/repos/yohcop/openid-go/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/yohcop/openid-go/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/yohcop/openid-go/git/refs{/sha}","trees_url":"https://api.github.com/repos/yohcop/openid-go/git/trees{/sha}","statuses_url":"https://api.github.com/repos/yohcop/openid-go/statuses/{sha}","languages_url":"https://api.github.com/repos/yohcop/openid-go/languages","stargazers_url":"https://api.github.com/repos/yohcop/openid-go/stargazers","contributors_url":"https://api.github.com/repos/yohcop/openid-go/contributors","subscribers_url":"https://api.github.com/repos/yohcop/openid-go/subscribers","subscription_url":"https://api.github.com/repos/yohcop/openid-go/subscription","commits_url":"https://api.github.com/repos/yohcop/openid-go/commits{/sha}","git_commits_url":"https://api.github.com/repos/yohcop/openid-go/git/commits{/sha}","comments_url":"https://api.github.com/repos/yohcop/openid-go/comments{/number}","issue_comment_url":"https://api.github.com/repos/yohcop/openid-go/issues/comments{/number}","contents_url":"https://api.github.com/repos/yohcop/openid-go/contents/{+path}","compare_url":"https://api.github.com/repos/yohcop/openid-go/compare/{base}...{head}","merges_url":"https://api.github.com/repos/yohcop/openid-go/merges","archive_url":"https://api.github.com/repos/yohcop/openid-go/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/yohcop/openid-go/downloads","issues_url":"https://api.github.com/repos/yohcop/openid-go/issues{/number}","pulls_url":"https://api.github.com/repos/yohcop/openid-go/pulls{/number}","milestones_url":"https://api.github.com/repos/yohcop/openid-go/milestones{/number}","notifications_url":"https://api.github.com/repos/yohcop/openid-go/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/yohcop/openid-go/labels{/name}","releases_url":"https://api.github.com/repos/yohcop/openid-go/releases{/id}","created_at":"2011-03-12T23:00:38Z","updated_at":"2016-01-16T23:33:50Z","pushed_at":"2016-01-18T02:53:30Z","git_url":"git://github.com/yohcop/openid-go.git","ssh_url":"git@github.com:yohcop/openid-go.git","clone_url":"https://github.com/yohcop/openid-go.git","svn_url":"https://github.com/yohcop/openid-go","homepage":"","size":63,"stargazers_count":33,"watchers_count":33,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":26,"mirror_url":null,"open_issues_count":4,"forks":26,"open_issues":4,"watchers":33,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/yohcop/openid-go/pulls/26"},"html":{"href":"https://github.com/yohcop/openid-go/pull/26"},"issue":{"href":"https://api.github.com/repos/yohcop/openid-go/issues/26"},"comments":{"href":"https://api.github.com/repos/yohcop/openid-go/issues/26/comments"},"review_comments":{"href":"https://api.github.com/repos/yohcop/openid-go/pulls/26/comments"},"review_comment":{"href":"https://api.github.com/repos/yohcop/openid-go/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/yohcop/openid-go/pulls/26/commits"},"statuses":{"href":"https://api.github.com/repos/yohcop/openid-go/statuses/54446dc86cc67a8f15763c28009db02cefcbf55f"}}}}