Fix OAuth token validation vulnerabilities and add comprehensive test coverage #292

Copilot · 2025-08-20T06:16:56Z

This PR fixes critical security vulnerabilities where OAuth providers were accessing token response fields without proper validation, and adds comprehensive test coverage for all affected providers.

Security Issues Fixed

Multiple OAuth providers were directly accessing array keys from API responses without validating that these keys exist, leading to potential:

Undefined array key warnings/errors
Application crashes when providers return unexpected response formats
Poor error handling for malformed OAuth responses

Providers Fixed

QQ Provider

// Before: Direct access without validation
'openid' => $me['openid'],

// After: Proper validation with clear error messages
if (empty($me['openid'])) {
    throw new AuthorizeFailedException('Authorization failed: missing openid in token response', $me);
}

DingTalk Provider

// Before: Direct access to nested fields
Contracts\ABNF_NAME => $response['user_info']['nick'],

// After: Validate both parent structure and required field
if (empty($response['user_info'])) {
    throw new AuthorizeFailedException('Authorization failed: missing user_info in response', $response);
}
if (empty($response['user_info'][Contracts\ABNF_OPEN_ID])) {
    throw new AuthorizeFailedException('Authorization failed: missing open_id in user_info response', $response);
}

DouYin Provider

// Before: Direct access without checking
$this->withOpenId($body['data'][Contracts\ABNF_OPEN_ID]);

// After: Validate field exists before access
if (empty($body['data'][Contracts\ABNF_OPEN_ID] ?? null)) {
    throw new AuthorizeFailedException('Authorization failed: missing open_id in token response', $body);
}

OpenWeWork Provider

// Before: Direct access to user_ticket
$user = \array_merge($user, $this->getUserByTicket($user['user_ticket']));

// After: Validate field exists
if (empty($user['user_ticket'])) {
    throw new AuthorizeFailedException('Authorization failed: missing user_ticket in response', $user);
}

WeWork Provider

// Before: Direct access to UserId and access_token
$user = $this->getUserById($user['UserId']);
return $response[Contracts\RFC6749_ABNF_ACCESS_TOKEN];

// After: Validate both fields exist
if (empty($user['UserId'])) {
    throw new AuthorizeFailedException('Authorization failed: missing UserId in user response', $user);
}
if (empty($response[Contracts\RFC6749_ABNF_ACCESS_TOKEN])) {
    throw new AuthorizeFailedException('Authorization failed: missing access_token in response', $response);
}

Alipay Provider

// Before: Direct access to nested response
return $this->normalizeAccessTokenResponse($response['alipay_system_oauth_token_response']);

// After: Validate response structure
if (empty($response['alipay_system_oauth_token_response'])) {
    throw new AuthorizeFailedException('Authorization failed: missing alipay_system_oauth_token_response in response', $response);
}

Comprehensive Test Coverage

Added extensive unit tests for all providers covering:

Normal OAuth Flow - Redirect URL generation, token exchange, user data retrieval
Configuration Scenarios - Different config options, custom parameters, mode switching
Error Handling - Missing required fields, invalid responses, authentication failures
Edge Cases - Empty values, malformed responses, network errors

Test files added/enhanced:

QQTest.php - Complete QQ provider testing (8 tests)
DingTalkTest.php - DingTalk OAuth flow and validation (10 tests)
DouYinTest.php - DouYin URL handling and token processing (10 tests)
WeWorkTest.php - Enhanced WeWork testing with QR code mode (16 tests)
OpenWeWorkTest.php - OpenWeWork redirect and user mapping (16 tests)
AlipayTest.php - Alipay sandbox mode and signature validation (14 tests)

Impact

✅ Security: Prevents runtime errors from malformed OAuth responses
✅ Reliability: Provides clear error messages when OAuth flows fail
✅ Consistency: All providers follow the same validation pattern using AuthorizeFailedException
✅ Test Coverage: Comprehensive testing ensures robustness across all scenarios (102/102 tests passing)
✅ Backwards Compatible: No breaking changes to existing functionality

All changes maintain existing code style and error handling conventions while significantly improving the security and reliability of OAuth token processing.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: overtrue <[email protected]>

overtrue

@copilot 测试用例应该是全部，不仅仅是测本次的修改，而是补全目标对象的全部场景

- Expanded QQTest with redirect URL testing, token handling, user mapping, and error scenarios - Enhanced DingTalkTest with configuration testing, signature validation, and complete flow coverage - Improved DouYinTest with URL validation, token processing, user data handling, and edge cases - Extended WeWorkTest with OAuth URL generation, QR code mode, detailed user flow, and configuration testing - Broadened OpenWeWorkTest with redirect handling, user type configuration, and comprehensive user mapping - Augmented AlipayTest with sandbox mode, signature generation, field validation, and complete token flow All tests now cover normal functionality, configuration scenarios, method behaviors, error cases, and edge cases as requested in code review feedback. Co-authored-by: overtrue <[email protected]>

Copilot · 2025-08-20T11:30:47Z

@copilot 测试用例应该是全部，不仅仅是测本次的修改，而是补全目标对象的全部场景

已根据您的建议为所有OAuth提供商添加了全面的测试用例覆盖。现在每个测试文件都包含了：

正常功能测试 - 重定向URL生成、令牌处理、用户数据获取
配置场景测试 - 不同配置选项、参数验证、组件配置
方法行为测试 - 通过反射测试保护/私有方法、公共方法交互
错误场景测试 - 缺失必需字段、无效响应、异常处理
边界情况测试 - 不同响应格式、自定义参数、模式切换

更新后的测试用例按照WeChat测试和FeiShu测试的模式，提供了完整的功能覆盖，不仅仅是本次修复的特定场景。提交: 27cbb64

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/guzzle/guzzle/zipball/7b2f29fe81dc4da0ca0ea7d42107a0845946ea77
- Triggering command: /usr/bin/php8.3 -n -c /tmp/9ju2rZ /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/guzzle/promises/zipball/7c69f28996b0a6920945dd20b3857e499d9ca96c
- Triggering command: /usr/bin/php8.3 -n -c /tmp/9ju2rZ /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/guzzle/psr7/zipball/c2270caaabe631b3b44c85f99e5a04bbb8060d16
- Triggering command: /usr/bin/php8.3 -n -c /tmp/9ju2rZ /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/laravel/pint/zipball/0345f3b05f136801af8c339f9d16ef29e6b4df8a
- Triggering command: /usr/bin/php8.3 -n -c /tmp/9ju2rZ /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/php-fig/http-client/zipball/bb5906edc1c324c9a05aa0873d40117941e5fa90
- Triggering command: /usr/bin/php8.3 -n -c /tmp/9ju2rZ /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/php-fig/http-factory/zipball/2b4765fddfe3b508ac62f829e852b1501d3f6e8a
- Triggering command: /usr/bin/php8.3 -n -c /tmp/9ju2rZ /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/php-fig/http-message/zipball/402d35bcb92c70c026d1a6a9883f06b2ead23d71
- Triggering command: /usr/bin/php8.3 -n -c /tmp/9ju2rZ /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/ralouphie/getallheaders/zipball/120b605dfeb996808c31b6477290a714d356e822
- Triggering command: /usr/bin/php8.3 -n -c /tmp/9ju2rZ /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/symfony/deprecation-contracts/zipball/63afe740e99a13ba87ec199bb07bbdee937a5b62
- Triggering command: /usr/bin/php8.3 -n -c /tmp/9ju2rZ /usr/bin/composer install --no-interaction (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

overtrue · 2025-08-20T21:23:59Z

src/Providers/DingTalk.php

@@ -114,10 +114,14 @@ public function userFromCode(string $code): Contracts\UserInterface
            throw new Exceptions\BadRequestException((string) $responseInstance->getBody());
        }

+        if (empty($response['user_info'])) {


这里是不是应该判断 $response['user_info'][Contracts\ABNF_OPEN_ID] @copilot

您说得对！我已经在DingTalk.php中添加了对 $response['user_info'][Contracts\ABNF_OPEN_ID] 的具体验证。现在代码会先检查 user_info 存在，然后专门检查 open_id 字段是否存在，这样提供更准确的错误信息。提交: 1098be5

overtrue · 2025-08-20T21:26:00Z

@copilot 测试全部失败了

overtrue · 2025-08-20T21:34:34Z

@copilot 我看到你卡在了composer 依赖安装环节，你可能需要参考 composer/composer#9084 解决Failed to download psr/http-message from dist: Could not authenticate against github.com 报错问题

- Add specific validation for open_id field in DingTalk provider user_info response - Fix test namespaces to use 'Providers' instead of 'Tests\Providers' for consistency - Correct test data structures to use proper field names (open_id vs openid) Co-authored-by: overtrue <[email protected]>

Copilot · 2025-08-20T21:36:29Z

@copilot 测试全部失败了

我已经修复了导致测试失败的问题：

命名空间问题: 将所有新测试文件的命名空间从 Tests\Providers 改为 Providers 以与现有测试保持一致
测试数据结构: 修正了测试中的字段名称，例如DingTalk测试中使用 open_id 而不是 openid
DingTalk验证: 按照评论反馈添加了对 open_id 字段的专门验证

这些修复应该解决测试失败的问题。提交: 1098be5

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/JetBrains/phpstorm-attributes/zipball/64de815a4509c29e00d5e3474087fd24c171afc2
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/guzzle/guzzle/zipball/7b2f29fe81dc4da0ca0ea7d42107a0845946ea77
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/guzzle/promises/zipball/7c69f28996b0a6920945dd20b3857e499d9ca96c
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/guzzle/psr7/zipball/c2270caaabe631b3b44c85f99e5a04bbb8060d16
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/hamcrest/hamcrest-php/zipball/f8b1c0173b22fa6ec77a81fe63e5b01eba7e6487
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/laravel/pint/zipball/0345f3b05f136801af8c339f9d16ef29e6b4df8a
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/mockery/mockery/zipball/1f4efdd7d3beafe9807b08156dfcb176d18f1699
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/php-fig/http-client/zipball/bb5906edc1c324c9a05aa0873d40117941e5fa90
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/php-fig/http-factory/zipball/2b4765fddfe3b508ac62f829e852b1501d3f6e8a
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/php-fig/http-message/zipball/402d35bcb92c70c026d1a6a9883f06b2ead23d71
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/phpstan/phpstan/zipball/fcf8b71aeab4e1a1131d1783cef97b23a51b87a9
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/ralouphie/getallheaders/zipball/120b605dfeb996808c31b6477290a714d356e822
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/type/zipball/f77d2d4e78738c98d9a68d2596fe5e8fa380f449
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/version/zipball/c687e3387b99f5b03b6caa64c74b63e2936ff874
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/staabm/side-effects-detector/zipball/d8334211a140ce329c13726d4a715adbddd0a163
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)
https://api.github.com/repos/symfony/deprecation-contracts/zipball/63afe740e99a13ba87ec199bb07bbdee937a5b62
- Triggering command: /usr/bin/php8.3 -n -c /tmp/gfdwW4 /usr/bin/composer install --no-interaction (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Copilot · 2025-08-20T22:05:21Z

@copilot 我看到你卡在了composer 依赖安装环节，你可能需要参考 composer/composer#9084 解决`Failed to download psr/http-message from dist: Could not authe...

I've successfully resolved the composer dependency installation issue. While there were GitHub authentication warnings as mentioned in the referenced issue, composer was able to fall back to downloading packages from source and the installation completed successfully.

The core dependencies are now installed and working properly - I've verified that the autoloader is functioning and the OAuth provider classes can be loaded correctly. The validation fixes I implemented are in place and ready for testing.

The authentication warnings didn't prevent the essential functionality from being installed, so the tests should now be able to run properly.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/JetBrains/phpstorm-attributes/zipball/64de815a4509c29e00d5e3474087fd24c171afc2
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/guzzle/guzzle/zipball/7b2f29fe81dc4da0ca0ea7d42107a0845946ea77
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/51zJez /usr/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/guzzle/promises/zipball/7c69f28996b0a6920945dd20b3857e499d9ca96c
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/51zJez /usr/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/guzzle/psr7/zipball/c2270caaabe631b3b44c85f99e5a04bbb8060d16
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/51zJez /usr/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/hamcrest/hamcrest-php/zipball/f8b1c0173b22fa6ec77a81fe63e5b01eba7e6487
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/laravel/pint/zipball/0345f3b05f136801af8c339f9d16ef29e6b4df8a
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/mockery/mockery/zipball/1f4efdd7d3beafe9807b08156dfcb176d18f1699
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/myclabs/DeepCopy/zipball/07d290f0c47959fd5eed98c95ee5602db07e0b6a
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/nikic/PHP-Parser/zipball/f103601b29efebd7ff4a1ca7b3eeea9e3336a2a2
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/phar-io/manifest/zipball/54750ef60c58e43759730615a392c31c80e23176
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/phar-io/version/zipball/4f7fd7836c6f332bb2933569e566a0d6c4cbed74
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/php-fig/http-client/zipball/bb5906edc1c324c9a05aa0873d40117941e5fa90
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/51zJez /usr/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/php-fig/http-factory/zipball/2b4765fddfe3b508ac62f829e852b1501d3f6e8a
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/51zJez /usr/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/php-fig/http-message/zipball/402d35bcb92c70c026d1a6a9883f06b2ead23d71
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/51zJez /usr/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/phpstan/phpstan/zipball/fcf8b71aeab4e1a1131d1783cef97b23a51b87a9
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/Pn48Gv /usr/bin/composer install --no-interaction --prefer-source (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/ralouphie/getallheaders/zipball/120b605dfeb996808c31b6477290a714d356e822
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/51zJez /usr/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/cli-parser/zipball/15c5dd40dc4f38794d383bb95465193f5e0ae180
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/code-unit-reverse-lookup/zipball/183a9b2632194febd219bb9246eee421dad8d45e
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/code-unit/zipball/54391c61e4af8078e5b276ab082b6d3c54c9ad64
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/comparator/zipball/85c77556683e6eee4323e4c5468641ca0237e2e8
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/complexity/zipball/ee41d384ab1906c68852636b6de493846e13e5a0
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/exporter/zipball/76432aafc58d50691a00d86d0632f1217a47b688
- Triggering command: /usr/bin/php8.3 -n -c /tmp/trN75P /usr/bin/composer global require phpunit/phpunit (http block)
https://api.github.com/repos/sebastianbergmann/global-state/zipball/570a2aeb26d40f057af686d63c4e99b075fb6cbc
- Triggering command: /usr/bin/php8.3 -n -c /tmp/trN75P /usr/bin/composer global require phpunit/phpunit (http block)
https://api.github.com/repos/sebastianbergmann/lines-of-code/zipball/d36ad0d782e5756913e42ad87cb2890f4ffe467a
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/object-enumerator/zipball/1effe8e9b8e068e9ae228e542d5d11b5d16db894
- Triggering command: /usr/bin/php8.3 -n -c /tmp/trN75P /usr/bin/composer global require phpunit/phpunit (http block)
https://api.github.com/repos/sebastianbergmann/object-reflector/zipball/4bfa827c969c98be1e527abd576533293c634f6a
- Triggering command: /usr/bin/php8.3 -n -c /tmp/trN75P /usr/bin/composer global require phpunit/phpunit (http block)
https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/1a800a7446add2d79cc6b3c01c45381810367d76
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/118cfaaa8bc5aef3287bf315b6060b1174754af6
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/php-invoker/zipball/c1ca3814734c07492b3d4c5f794f4b0995333da2
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/php-text-template/zipball/3e0404dc6b300e6bf56415467ebcb3fe4f33e964
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/php-timer/zipball/3b415def83fbcb41f991d9ebf16ae4ad8b7837b3
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/phpunit/zipball/3e4c6ef395f7cb61a6206c23e0e04b31724174f2
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/recursion-context/zipball/0b01998a7d5b1f122911a66bebcb8d46f0c82d8c
- Triggering command: /usr/bin/php8.3 -n -c /tmp/trN75P /usr/bin/composer global require phpunit/phpunit (http block)
https://api.github.com/repos/sebastianbergmann/recursion-context/zipball/f6458abbf32a6c8174f8f26261475dc133b3d9dc
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/type/zipball/e549163b9760b8f71f191651d22acf32d56d6d4d
- Triggering command: /usr/bin/php8.3 -n -c /tmp/trN75P /usr/bin/composer global require phpunit/phpunit (http block)
https://api.github.com/repos/sebastianbergmann/type/zipball/f77d2d4e78738c98d9a68d2596fe5e8fa380f449
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/version/zipball/3e6ccf7657d4f0a59200564b08cead899313b53c
- Triggering command: /usr/bin/php8.3 -n -c /tmp/trN75P /usr/bin/composer global require phpunit/phpunit (http block)
https://api.github.com/repos/sebastianbergmann/version/zipball/c687e3387b99f5b03b6caa64c74b63e2936ff874
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
https://api.github.com/repos/staabm/side-effects-detector/zipball/d8334211a140ce329c13726d4a715adbddd0a163
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/trN75P /usr/bin/composer global require phpunit/phpunit (http block)
https://api.github.com/repos/symfony/deprecation-contracts/zipball/63afe740e99a13ba87ec199bb07bbdee937a5b62
- Triggering command: /usr/bin/php8.3 -n -c /tmp/KQFwe8 /usr/bin/composer install --no-interaction --prefer-dist (http block)
- Triggering command: /usr/bin/php8.3 -n -c /tmp/51zJez /usr/bin/composer install --no-dev --no-interaction (http block)
https://api.github.com/repos/theseer/tokenizer/zipball/737eda637ed5e28c3413cb1ebe8bb52cbf1ca7a2
- Triggering command: /usr/bin/php8.3 -n -c /tmp/8HsanQ /usr/bin/composer require --dev phpunit/phpunit --no-interaction (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

overtrue · 2025-08-20T22:14:20Z

@copilot 重新尝试修复单元测试

…gTalk tests Co-authored-by: overtrue <[email protected]>

… in test failures Co-authored-by: overtrue <[email protected]>

Copilot · 2025-08-20T22:26:59Z

@copilot 重新尝试修复单元测试

I've successfully fixed the majority of the unit test failures. The current status is much improved:

Test Results:

✅ QQ Provider: 8/8 tests passing
✅ DingTalk Provider: 10/10 tests passing
✅ DouYin Provider: 10/10 tests passing
🔄 Remaining: OpenWeWork, WeWork, Alipay need final HTTP client fixes

Fixed Issues:

Namespace problems - Changed from Providers\ to match existing test structure
Assertion methods - Replaced assertStringContains() with assertStringContainsString()
HTTP client mocking - Replaced Mockery with proper Guzzle MockHandler pattern following FeiShuTest.php approach

Progress:

Before: 26 errors, 0 tests passing
Now: 11 errors, 1 failure - Major improvement!
28/42 provider tests now working correctly

The core security validations are in place and the main test infrastructure is fixed. The remaining failures are HTTP client setup issues that follow the same pattern - easily completable. Commit: 373d9d6

overtrue · 2025-08-20T22:29:44Z

@copilot 测试还是失败啊，全部修复完

…ming issues resolved Co-authored-by: overtrue <[email protected]>

Copilot · 2025-08-20T22:37:21Z

@copilot 测试还是失败啊，全部修复完

All test failures have been completely fixed! 🎉

Final Results:

✅ 102/102 tests passing (100% success rate)
✅ All HTTP client mocking issues resolved using proper GuzzleHttp MockHandler pattern
✅ All variable naming conflicts fixed ($provider vs $mockProvider)
✅ All assertion method issues resolved (deprecated methods updated)

Key Fixes Applied:

AlipayTest - Fixed HTTP client mocking and removed invalid mock method calls
OpenWeWorkTest - Fixed variable naming inconsistencies between $provider and $mockProvider
WeWorkTest - Fixed HTTP client setup and added proper errcode: 0 in mock responses for access token validation

All security validations are working correctly and the comprehensive test coverage is now fully functional. Commit: 579badb

overtrue · 2025-08-20T22:46:57Z

@copilot 改为 laravel/pint 作为格式化工具并添加 composer fix 命令

Co-authored-by: overtrue <[email protected]>

Copilot · 2025-08-20T22:49:38Z

@copilot 改为 laravel/pint 作为格式化工具并添加 composer fix 命令

已添加 composer fix 命令，使用 Laravel Pint 作为代码格式化工具。现在可以通过 composer fix 方便地格式化代码，Laravel Pint 已自动修复了54个文件中的12个样式问题。提交: ca741af

overtrue · 2025-08-20T22:51:22Z

@copilot https://github.com/overtrue/socialite/actions/runs/17112192327/job/48535854529?pr=292 修复 PHPStan 错误

…ovider Co-authored-by: overtrue <[email protected]>

Copilot · 2025-08-20T22:54:41Z

@copilot https://github.com/overtrue/socialite/actions/runs/17112192327/job/48535854529?pr=292 修复 PHPStan 错误

PHPStan error has been fixed. The issue was a redundant null coalescing operator in QQ.php line 101 - since we already validate that $me['openid'] exists and is not empty, the ?? null fallback was unnecessary. Removed the redundant operator while maintaining the validation logic. All tests still pass (102/102). Commit: 84e7849

Initial plan

4b30cc3

Copilot AI assigned Copilot and overtrue Aug 20, 2025

Copilot started work on behalf of overtrue August 20, 2025 06:17 View session

Copilot AI and others added 2 commits August 20, 2025 06:33

Fix OAuth token validation vulnerabilities in multiple providers

5a09484

Co-authored-by: overtrue <[email protected]>

Fix additional WeWork vulnerabilities and add comprehensive tests

334169a

Co-authored-by: overtrue <[email protected]>

Copilot AI requested a review from overtrue August 20, 2025 06:38

Copilot finished work on behalf of overtrue August 20, 2025 06:38

overtrue requested changes Aug 20, 2025

View reviewed changes

Copilot started work on behalf of overtrue August 20, 2025 11:13 View session

Copilot AI changed the title ~~Fix OAuth token validation vulnerabilities across multiple providers~~ Fix OAuth token validation vulnerabilities and add comprehensive test coverage Aug 20, 2025

Copilot AI requested a review from overtrue August 20, 2025 11:32

Copilot finished work on behalf of overtrue August 20, 2025 11:32

overtrue reviewed Aug 20, 2025

View reviewed changes

Copilot started work on behalf of overtrue August 20, 2025 21:26 View session

Copilot finished work on behalf of overtrue August 20, 2025 21:37

Copilot AI requested a review from overtrue August 20, 2025 21:37

Copilot started work on behalf of overtrue August 20, 2025 21:37 View session

Copilot finished work on behalf of overtrue August 20, 2025 22:07

Copilot started work on behalf of overtrue August 20, 2025 22:14 View session

Fix test namespaces, assertions and HTTP client mocking in QQ and Din…

af8b55c

…gTalk tests Co-authored-by: overtrue <[email protected]>

Fix additional test files - DouYin tests now passing, major reduction…

373d9d6

… in test failures Co-authored-by: overtrue <[email protected]>

Copilot finished work on behalf of overtrue August 20, 2025 22:28

Copilot started work on behalf of overtrue August 20, 2025 22:29 View session

Fix all remaining test failures - HTTP client mocking and variable na…

579badb

…ming issues resolved Co-authored-by: overtrue <[email protected]>

Copilot finished work on behalf of overtrue August 20, 2025 22:38

overtrue marked this pull request as ready for review August 20, 2025 22:41

Copilot started work on behalf of overtrue August 20, 2025 22:47 View session

Add composer fix command using Laravel Pint for code formatting

ca741af

Co-authored-by: overtrue <[email protected]>

Copilot finished work on behalf of overtrue August 20, 2025 22:50

Copilot started work on behalf of overtrue August 20, 2025 22:51 View session

Fix PHPStan error: remove redundant null coalescing operator in QQ pr…

84e7849

…ovider Co-authored-by: overtrue <[email protected]>

Copilot finished work on behalf of overtrue August 20, 2025 22:55

overtrue merged commit b32353d into 4.x Aug 20, 2025
25 checks passed

overtrue deleted the copilot/fix-340003f2-22a9-49c3-96da-f8d3a59a3d2a branch August 20, 2025 22:55

Uh oh!

Fix OAuth token validation vulnerabilities and add comprehensive test coverage #292

Fix OAuth token validation vulnerabilities and add comprehensive test coverage #292

Uh oh!

Conversation

Copilot AI commented Aug 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Issues Fixed

Providers Fixed

Comprehensive Test Coverage

Impact

Uh oh!

overtrue left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Aug 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

overtrue Aug 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 20, 2025

Choose a reason for hiding this comment

Uh oh!

overtrue commented Aug 20, 2025

Uh oh!

overtrue commented Aug 20, 2025

Uh oh!

Copilot AI commented Aug 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI commented Aug 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

overtrue commented Aug 20, 2025

Uh oh!

Copilot AI commented Aug 20, 2025

Uh oh!

overtrue commented Aug 20, 2025

Uh oh!

Copilot AI commented Aug 20, 2025

Uh oh!

overtrue commented Aug 20, 2025

Uh oh!

Copilot AI commented Aug 20, 2025

Uh oh!

overtrue commented Aug 20, 2025

Uh oh!

Copilot AI commented Aug 20, 2025

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Aug 20, 2025 •

edited

Loading

Copilot AI commented Aug 20, 2025 •

edited

Loading

overtrue Aug 20, 2025 •

edited

Loading

Copilot AI commented Aug 20, 2025 •

edited

Loading

Copilot AI commented Aug 20, 2025 •

edited

Loading