Benign lua Download

lua-resty-openidc 1.9.2-1

“A library for NGINX implementing the OpenID Connect Relying Party (RP) and the OAuth 2.0 Resource Server (RS) functionality”

Basename is uppercase README.mdSource references XOR syntax

SHA-256318dc289b2c1c35e568bc6d66e0f1bc9b48b792f26301eeadef1437af8f87e92

URLhttps://luarocks.org/lua-resty-openidc-1.9.2-1.src.rock

MaleculeO₂(IXe)H₆(Cm₁₉Db₅F₂Os₃Po₃U)Md₅(Bk₄In₉Pa₄Pt)

Evidence

imports socket.http redirect_to_op_spec.lua · lines 1–17

1local http = require("socket.http")
2local test_support = require("test_support")
3require 'busted.runner'()
4
5describe("when accessing the protected resource without token", function()
test_support.start_server()
teardown(test_support.stop_server)
local _, status, headers = http.request({
  url = "http://127.0.0.1/default/t",
  redirect = false
})
it("redirects to the authorization endpoint", function()
  assert.are.equals(302, status)
  assert.truthy(string.match(headers["location"], "http://127.0.0.1/authorize%?.*client_id=client_id.*"))
end)
it("HTTP Caching is disabled", function()
  assert.are.equals("no-cache, no-store, max-age=0", header …

HTTP URL string literal redirect_to_op_spec.lua · lines 22–31

49… n()
  local redir_escaped = test_support.urlescape_for_regex("http://localhost/default/redirect_uri")
  -- lower as url.escape uses %2f for a slash, openidc uses %2F
  assert.truthy(string.match(string.lower(headers["location"]),
                             ".*redirect_uri=" .. string.lower(redir_escaped) .. ".*"))
end)
it("uses a state parameter", function()
  assert.truthy(string.match(headers["location"], ".*state=.*"))
end)
it("uses a nonce parameter", …

curl command includes URL or option redirect_to_op_spec.lua · lines 376–382

14…  module doesn't support specifying multiple headers
local r = io.popen("curl -H 'X-Forwarded-Host: example.org' -H 'X-Forwarded-Host: example.com'"
                     .. " -o /dev/null -v --max-redirs 0 http://127.0.0.1/default/t 2>&1")
local o = r:read("*a")
r:close()
it("the first header is used", function()
  assert.truthy(string.matc …

Lua reads an HTTP request field test_support.lua · lines 168–182

168:45… TURE")
169  end
170end
171test_globals.query_decorator = function(req)
172  req.query = "foo=bar"
173  return req
174end
175test_globals.body_decorator = function(req)
176  local body = ngx.decode_args(req.body)
177  body.foo = "bar"
178  req.body = ngx.encode_args(body)
⋯4 lines

Embedded command executes a temporary path test_support.lua · lines 209–223

209:33… [[
210worker_processes  WORKER_PROCESSES;
211pid       /tmp/server/logs/nginx.pid;
212error_log /tmp/server/logs/error.log debug;
213
⋯4 lines
218http {
219    access_log /tmp/server/logs/access.log;
220    lua_package_path '~/lua/?.lua;/tmp/server/conf/?.lua;;';
221    lua_shared_dict discovery 1m;
222    lua_shared_dict introspection INTROSPECTION_SHARED_DICT_SIZE;
223    lua_shared_dict jwt …

Showing the top 5 files — 7 more files (104 regions) not shown.

No evidence locations were recorded for this file. Raw result