Merge pull request jenkinsci#90 from Wadeck/ACCESS_TOKEN_FIRST_RETRIEVAL

samrocketman · web-flow · commit 66021058bc41 · 2017-11-18T11:15:45.000-08:00
Potential bug in access_token retrieval method
diff --git a/src/main/java/org/jenkinsci/plugins/GithubSecurityRealm.java b/src/main/java/org/jenkinsci/plugins/GithubSecurityRealm.java
@@ -426,7 +426,7 @@ private String getAccessToken(@Nonnull String code) throws IOException {
         }
         String parts[] = content.split("&");
         for (String part : parts) {
-            if (content.contains("access_token")) {
+            if (part.startsWith("access_token=")) {
                 String tokenParts[] = part.split("=");
                 return tokenParts[1];
             }

Original file line number	Diff line number	Diff line change
`@@ -426,7 +426,7 @@ private String getAccessToken(@Nonnull String code) throws IOException {`
`426`	`426`	`}`
`427`	`427`	`String parts[] = content.split("&");`
`428`	`428`	`for (String part : parts) {`
`429`		`- if (content.contains("access_token")) {`
	`429`	`+ if (part.startsWith("access_token=")) {`
`430`	`430`	`String tokenParts[] = part.split("=");`
`431`	`431`	`return tokenParts[1];`
`432`	`432`	`}`