Conversation
변경 전: + 문자가 url 디코딩되며 공백으로 변경됨에 따라 토큰 폐기 실패 변경 후: + 문자를 %2B로 인코딩해서 전송
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughThe Naver OAuth client now URL-encodes the access token parameter (using UTF-8) in its revoke flow. A new unit test was added to verify UriUtils encoding/decoding behavior for the plus character. Changes
Sequence Diagram(s)sequenceDiagram
participant Client as NaverOAuthClient
participant Revocation as Naver Revocation Endpoint
rect rgb(240,248,255)
Note left of Client: Revoke(token)
end
alt Before (previous)
Client->>Revocation: GET /revoke?access_token=<raw_token>
Revocation-->>Client: revocation response
else After (this change)
Client->>Client: encoded = UriUtils.encode(token, StandardCharsets.UTF_8)
Client->>Revocation: GET /revoke?access_token=<encoded>
Revocation-->>Client: revocation response
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @huhdy32, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! 이 PR은 Naver OAuth 토큰 폐기 과정에서 발생하는 인코딩 관련 버그를 수정합니다. 기존에는 액세스 토큰 내의 '+' 문자가 URL 디코딩 시 공백으로 잘못 해석되어 토큰 폐기 요청이 실패했습니다. 이를 해결하기 위해, 액세스 토큰을 쿼리 파라미터로 전송하기 전에 Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
...n/mathrank-auth-domain/src/main/java/kr/co/mathrank/domain/auth/client/NaverOAuthClient.java
Outdated
Show resolved
Hide resolved
...in/mathrank-auth-domain/src/test/java/kr/co/mathrank/domain/auth/util/UriUtilEncodeTest.java
Outdated
Show resolved
Hide resolved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
domain/mathrank-auth-domain/src/main/java/kr/co/mathrank/domain/auth/client/NaverOAuthClient.java(2 hunks)domain/mathrank-auth-domain/src/test/java/kr/co/mathrank/domain/auth/util/UriUtilEncodeTest.java(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: test
🔇 Additional comments (1)
domain/mathrank-auth-domain/src/test/java/kr/co/mathrank/domain/auth/util/UriUtilEncodeTest.java (1)
12-13: Let me verify the StringUtils.uriDecode behavior to be completely certain:Use
StandardCharsets.UTF_8instead ofCharset.defaultCharset()for consistency.UriUtils.decode replaces "%xy" sequences while "letting other characters unchanged", so the "+" character is passed through unchanged during decoding. Line 13's assertion is correct as-is. The only issue is the charset: URL encoding should use explicit UTF-8 rather than relying on system-dependent defaults.
Apply this diff:
import java.nio.charset.Charset; +import java.nio.charset.StandardCharsets; import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.Test; @@ -9,7 +10,7 @@ import org.springframework.web.util.UriUtils; class UriUtilEncodeTest { @Test void plus_문자_인코딩_테스트() { - Assertions.assertNotEquals("+", UriUtils.encode("+", Charset.defaultCharset())); - Assertions.assertEquals("+", UriUtils.decode("+", Charset.defaultCharset())); + Assertions.assertNotEquals("+", UriUtils.encode("+", StandardCharsets.UTF_8)); + Assertions.assertEquals("+", UriUtils.decode("+", StandardCharsets.UTF_8)); } }Likely an incorrect or invalid review comment.
...n/mathrank-auth-domain/src/main/java/kr/co/mathrank/domain/auth/client/NaverOAuthClient.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
domain/mathrank-auth-domain/src/main/java/kr/co/mathrank/domain/auth/client/NaverOAuthClient.java (1)
3-3: Remove unused import.The
Charsetimport is no longer used since the code now correctly referencesStandardCharsets.UTF_8directly on line 71. This import should be removed to keep the code clean.Apply this diff:
-import java.nio.charset.Charset; import java.nio.charset.StandardCharsets;
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
domain/mathrank-auth-domain/src/main/java/kr/co/mathrank/domain/auth/client/NaverOAuthClient.java(2 hunks)domain/mathrank-auth-domain/src/test/java/kr/co/mathrank/domain/auth/util/UriUtilEncodeTest.java(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- domain/mathrank-auth-domain/src/test/java/kr/co/mathrank/domain/auth/util/UriUtilEncodeTest.java
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: test
🔇 Additional comments (1)
domain/mathrank-auth-domain/src/main/java/kr/co/mathrank/domain/auth/client/NaverOAuthClient.java (1)
71-71: Encoding fix correctly addresses the '+' character issue in token revocation flow.The manual encoding using
UriUtils.encode()withStandardCharsets.UTF_8on line 71 correctly solves the problem where '+' characters in access tokens were being converted to spaces. This approach is necessary because Spring'squeryParam()method doesn't percent-encode legal RFC 3986 characters like '+'.While verification confirms that
code,state, andrefresh_tokenparameters ingetAccessToken()andrefreshAccessToken()also usequeryParam(), no encoding issues have been reported for these parameters. Since the PR scope is specifically fixing the token revocation flow, extending encoding to other OAuth methods is optional follow-up work outside this change's intended scope.
…)" This reverts commit 996405a.
1 participant
문제
query param으로 전달되는 access token에
+문자가 존재할 시,네이버 oauth 서버의 디코딩 과정에서 access token의
+이 공백으로 치환됨.이에 따라 토큰 폐기 실패하는 문제가 있었음.
해결
RestClient에서 당연히 인코딩 처리해줄줄 알았으나,문서 내용을 읽어보니, ASCII 위반 문자만 개별적으로 인코딩하도록 함 ㅠ
-> UTF-8인코딩 후, 퍼센트 인코딩으로 해결
Summary by CodeRabbit
Bug Fixes
Tests