From fbf6fe129b4e659370dac8fc8d667c82c1ded85e Mon Sep 17 00:00:00 2001 From: uditDewan Date: Tue, 30 Jun 2026 01:37:33 -0400 Subject: [PATCH] Reject non-space whitespace in NonceUtil.isValidNonce isValidNonce intended to reject any nonce containing whitespace, but the check used nonce.indexOf(' '), which only matches the literal space character. A nonce containing a tab, newline, or carriage return passed validation despite the local being named hasWhiteSpace. Such a nonce is later sent into the OIDC login flow via LoginConfiguration, where embedded whitespace can break request handling. Switch to Char.isWhitespace() so all whitespace characters are rejected, and add regression tests for tab, newline, and carriage return. Co-authored-by: Baradhan-Madhu <26barumadhu@gmail.com> --- .../src/main/java/com/facebook/login/NonceUtil.kt | 2 +- .../src/test/kotlin/com/facebook/login/NonceUtilTest.kt | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/facebook-common/src/main/java/com/facebook/login/NonceUtil.kt b/facebook-common/src/main/java/com/facebook/login/NonceUtil.kt index c7995c7934..a9377c4ef9 100644 --- a/facebook-common/src/main/java/com/facebook/login/NonceUtil.kt +++ b/facebook-common/src/main/java/com/facebook/login/NonceUtil.kt @@ -15,7 +15,7 @@ object NonceUtil { return false } - val hasWhiteSpace = nonce.indexOf(' ') >= 0 + val hasWhiteSpace = nonce.any { it.isWhitespace() } return !hasWhiteSpace } } diff --git a/facebook-common/src/test/kotlin/com/facebook/login/NonceUtilTest.kt b/facebook-common/src/test/kotlin/com/facebook/login/NonceUtilTest.kt index 9175efcffb..592c1adff0 100644 --- a/facebook-common/src/test/kotlin/com/facebook/login/NonceUtilTest.kt +++ b/facebook-common/src/test/kotlin/com/facebook/login/NonceUtilTest.kt @@ -24,6 +24,13 @@ class NonceUtilTest : FacebookPowerMockTestCase() { assertThat(NonceUtil.isValidNonce("nonce ")).isFalse } + @Test + fun `test nonce with non-space whitespace is invalid`() { + assertThat(NonceUtil.isValidNonce("nonce\t")).isFalse + assertThat(NonceUtil.isValidNonce("nonce\n")).isFalse + assertThat(NonceUtil.isValidNonce("non\rce")).isFalse + } + @Test fun `test empty nonce`() { assertThat(NonceUtil.isValidNonce("")).isFalse