Merge pull request #438 from ForgeRock/SDKS-3346

SDKS-3346 Potential CustomTabManager ServiceConnection leak.
ForgeRock · Aug 14, 2024 · ebb50f3 · ebb50f3
2 parents cca75e5 + f6d1ca8
commit ebb50f3
Show file tree

Hide file tree

Showing 5 changed files with 19 additions and 9 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,9 @@
 #### Added
 - Skip Type 4 TextOutputCallback [SDKS-3227]
 
+#### Fixed
+- Potential CustomTabManager ServiceConnection leak. [SDKS-3346]
+
 ## [4.5.0]
 #### Added
 - Added SDK support for deleting registered WebAuthn devices from the server. [SDKS-1710]

diff --git a/forgerock-auth/src/main/java/org/forgerock/android/auth/centralize/AuthorizeContract.kt b/forgerock-auth/src/main/java/org/forgerock/android/auth/centralize/AuthorizeContract.kt
@@ -30,6 +30,9 @@ import org.forgerock.android.auth.exception.BrowserAuthenticationException
  */
 internal class AuthorizeContract :
     ActivityResultContract<Browser, Result<AuthorizationResponse, Throwable>>() {
+
+    private lateinit var authorizationService: AuthorizationService
+
     /**
      * Creates an intent for the authorization request.
      *
@@ -63,7 +66,7 @@ internal class AuthorizeContract :
         //Allow caller to override AppAuth default setting
         val appAuthConfigurationBuilder = AppAuthConfiguration.Builder()
         configurer.appAuthConfigurationBuilder.accept(appAuthConfigurationBuilder)
-        val authorizationService =
+        authorizationService =
             AuthorizationService(context, appAuthConfigurationBuilder.build())
 
         //Allow caller to override custom tabs default setting
@@ -73,7 +76,6 @@ internal class AuthorizeContract :
 
         val request = builder.build()
         return authorizationService.getAuthorizationRequestIntent(request, intentBuilder.build())
-
     }
 
     /**
@@ -87,6 +89,7 @@ internal class AuthorizeContract :
         resultCode: Int,
         intent: Intent?,
     ): Result<AuthorizationResponse, Throwable> {
+        authorizationService.dispose()
         intent?.let { i ->
             val error = AuthorizationException.fromIntent(i)
             error?.let {
@@ -100,7 +103,8 @@ internal class AuthorizeContract :
             val result = AuthorizationResponse.fromIntent(i)
             result?.let {
                 return Result.Success(it)
-            } ?: return Result.Failure(BrowserAuthenticationException("Failed to retrieve authorization code"))
+            }
+                ?: return Result.Failure(BrowserAuthenticationException("Failed to retrieve authorization code"))
         }
         return Result.Failure(BrowserAuthenticationException("No response data"))
     }

diff --git a/forgerock-auth/src/main/java/org/forgerock/android/auth/centralize/EndSessionContract.kt b/forgerock-auth/src/main/java/org/forgerock/android/auth/centralize/EndSessionContract.kt
@@ -26,6 +26,9 @@ import org.forgerock.android.auth.StringUtils
  */
 internal class EndSessionContract :
     ActivityResultContract<EndSessionInput, Result<EndSessionResponse, Throwable>>() {
+
+    private lateinit var authorizationService: AuthorizationService
+
     /**
      * Creates an intent for the end session request.
      * @param context The context to use for creating the intent.
@@ -52,10 +55,10 @@ internal class EndSessionContract :
             builder.setIdTokenHint(input.idToken)
         }
 
-        val authService =
+        authorizationService =
             AuthorizationService(context, input.appAuthConfiguration)
 
-        return authService.getEndSessionRequestIntent(builder.build())
+        return authorizationService.getEndSessionRequestIntent(builder.build())
     }
 
     /**
@@ -68,6 +71,7 @@ internal class EndSessionContract :
         resultCode: Int,
         intent: Intent?,
     ): Result<EndSessionResponse, Throwable> {
+        authorizationService.dispose()
         intent?.let { i ->
             val resp = EndSessionResponse.fromIntent(i)
             resp?.let {

diff --git a/forgerock-auth/src/test/java/org/forgerock/android/auth/ServerConfigTest.java b/forgerock-auth/src/test/java/org/forgerock/android/auth/ServerConfigTest.java
@@ -80,7 +80,7 @@ public void testSha256Pinning() throws InterruptedException {
         ServerConfig serverConfig = ServerConfig.builder()
                 .context(context)
                 .url("https://api.ipify.org")
-                .pin("2lFvaIHpsTcbb5uqa08S2k6wzLKscXXx1k1hKoX9R1Q=")
+                .pin("tWrCr1GAahCs75/Wfx+5pjRXCtOTzMPyw8TNPPivO0I=")
                 .build();
 
         OkHttpClient client = OkHttpClientProvider.getInstance().lookup(serverConfig);
@@ -122,7 +122,7 @@ public void testMultiplePinning() throws InterruptedException {
         ServerConfig serverConfig = ServerConfig.builder()
                 .context(context)
                 .url("https://api.ipify.org")
-                .pin("2lFvaIHpsTcbb5uqa08S2k6wzLKscXXx1k1hKoX9R1Q=")
+                .pin("tWrCr1GAahCs75/Wfx+5pjRXCtOTzMPyw8TNPPivO0I=")
                 .pin("invalid")
                 .build();
 
@@ -214,7 +214,7 @@ public void testBuildStepWithCustomPin() throws InterruptedException {
                 .context(context)
                 .url("https://api.ipify.org")
                 .buildStep(builder -> builder.certificatePinner(
-                        new CertificatePinner.Builder().add("api.ipify.org", "sha1/FAx66BsuUMrmrBnZ8F0GKxBZxLs=" ).build()))
+                        new CertificatePinner.Builder().add("api.ipify.org", "sha256/tWrCr1GAahCs75/Wfx+5pjRXCtOTzMPyw8TNPPivO0I=" ).build()))
                 .build();
 
         OkHttpClient client = OkHttpClientProvider.getInstance().lookup(serverConfig);

diff --git a/samples/app/src/main/java/com/example/app/env/EnvViewModel.kt b/samples/app/src/main/java/com/example/app/env/EnvViewModel.kt
@@ -127,7 +127,6 @@ class EnvViewModel : ViewModel() {
         }
         oauth {
             oauthClientId = "AndroidTest"
-            oauthRedirectUri = "org.forgerock.demo:/oauth2redirect"
             oauthCacheSeconds = 0
             oauthScope = "openid profile email address phone"
             oauthThresholdSeconds = 0