Bug
OAuth 1.0 always signs with HMAC-SHA256 (sha256Hash). signature_method is copied into the oauth_signature_method Authorization parameter (default HMAC-SHA256) but is never used to select an algorithm. Setting HMAC-SHA1 produces a header that claims SHA1 while the signature is still SHA256.
Where
internal/pkg/pipeline/task/http/oauth1.go (always sha256Hash) and oauth_resolve.go (SignatureMethod copied through).
Expected
Either honor signature_method or reject values other than HMAC-SHA256 at resolve time.
Found while auditing task READMEs in #96.
Bug
OAuth 1.0 always signs with HMAC-SHA256 (
sha256Hash).signature_methodis copied into theoauth_signature_methodAuthorization parameter (defaultHMAC-SHA256) but is never used to select an algorithm. SettingHMAC-SHA1produces a header that claims SHA1 while the signature is still SHA256.Where
internal/pkg/pipeline/task/http/oauth1.go(alwayssha256Hash) andoauth_resolve.go(SignatureMethodcopied through).Expected
Either honor
signature_methodor reject values other thanHMAC-SHA256at resolve time.Found while auditing task READMEs in #96.