[BUG] OAuth hash seems to be generated differently per OS
bsz-fis opened this issue · comments
Bug Report Checklist
- [Y] Have you provided a code sample to reproduce the issue?
- [Y ] Have you tested with the latest release to confirm the issue still exists?
- [Y] Have you searched for related issues/PRs?
- [Y] What's the actual output vs expected output?
Description
I am unable to access Sandbox MDES environment. I tried debugging my issue with MC Support, Case# 04022094.
It simply confirmed that whatever configuration I have seems correct. Then I came to a conclusion that the issue must be system dependent. To prove it I have prepared a simple project, copying your code from:
com.mastercard.developer.oauth.OAuth.getBodyHash(String, Charset, String)
And replacing improper usage of proprietary sun classes with appropriate one (anyhow, same result is produced, at least for my case).
To Reproduce
Simply run: mvn clean install, on the attached module.
mdes-test.zip
Expected behavior
Test in that class should display string: 6ZfZQnr07GwaA/sSwqVKGSVyriLSiHoMK+zxL3ZtKYo=
While I am receiving an actual string: 89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0=
Screenshots
No screenshot is needed.
Sandbox API responds with error that value calculated by Mastercard (expected string above) differs from the one received (actual string above).
Additional context
openjdk version "1.8.0_345"
OpenJDK Runtime Environment (Temurin)(build 1.8.0_345-b01)
OpenJDK 64-Bit Server VM (Temurin)(build 25.345-b01, mixed mode)
Related issues/PRs
There aren't related issues.
Suggest a fix/enhancement
I believe that code in: com.mastercard.developer.oauth.OAuth.getBodyHash(String, Charset, String)
is giving different results per either OS or JDK version, surely there is a mismatch.
I've upgraded to latest JDK8 and the result is remaining the same.
I am striving for results of running project I attached on your end.
openjdk version "1.8.0_382"
OpenJDK Runtime Environment (Temurin)(build 1.8.0_382-b05)
OpenJDK 64-Bit Server VM (Temurin)(build 25.382-b05, mixed mode)
As you requested for completeness I am sharing versions of Maven I've used for testing:
- Apache Maven 3.5.3 (with which I was originally testing)
- Apache Maven 3.6.3
- Apache Maven 3.9.4 (which is the latest)
I did the tests, even though it makes no difference as exactly same result I am able to get with purely running the file with JAVA (even during the support call).
I have even done more testing. I've checked results of your hashing algorithm method in all publicly available versions of oauth1-signer and results are the same across all of them! This looks more like an issue coming from using proprietary Sun classes in your code, on your server hosting Sandbox. I am really curious about results from running my small application on your servers, using same version of JDK as used for hosting Sandbox.
Details of testing described:
{'1.5.2': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0='], '1.5.1': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0='], '1.5.0': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0='], '1.4.0': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0='], '1.3.0': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0='], '1.2.4': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0=']'1.2.3': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0='], '1.2.2': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0='], '1.2.1': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0=']}
For lower versions your method is lacking 3rd parameter, i.e. you don't expect giving hashing algorithm, but anyway same results are also coming from these:
{'1.2.0': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0='], '1.1.1': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0='], '1.1.0': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0='], '1.0.0': ['89jfVv9wBxgaBZ0CV8b9XNd7yRtw+IOVub7OEedTVx0=']}
@bsz-fis Thanks for creating this issue! Giving the complexity of replicating the issue, it's going to be difficult for us to provide a fix that will satisfy all OS use cases. We would be happy to take a look at a PR if you had an idea of how to remediate the issue you're facing without impacting other users.
Closing for now, as mentioned above, please feel free to create a PR addressing this issue and we'll be happy to take a look.