Summary
Sending an OAuth token request where the code or client_id form parameter contains a null byte (%00) causes SimpleLogin's token endpoint to return HTTP 500 (its generic "Server error" HTML page) instead of the RFC 6749 §5.2 error response (HTTP 400 with a JSON {"error": "..."} body).
Affected Endpoint
POST /oauth2/token
Steps to Reproduce
# Null byte in code → HTTP 500
curl -i -X POST 'http://localhost:7777/oauth2/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=authorization_code&code=test%00code&client_id=fuzz-client&client_secret=secret'
# Null byte in client_id → HTTP 500
curl -i -X POST 'http://localhost:7777/oauth2/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=authorization_code&code=test&client_id=fuzz-client%00evil&client_secret=secret'
Actual response (both):
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
<html>... "Server error — Looks like we are having some server issues..." ...</html>
Expected response (RFC 6749 §5.2):
HTTP/1.1 400 Bad Request
Content-Type: application/json
{"error": "invalid_request"}
Summary
Sending an OAuth token request where the
codeorclient_idform parameter contains a null byte (%00) causes SimpleLogin's token endpoint to return HTTP 500 (its generic "Server error" HTML page) instead of the RFC 6749 §5.2 error response (HTTP 400 with a JSON{"error": "..."}body).Affected Endpoint
POST /oauth2/tokenSteps to Reproduce
Actual response (both):
Expected response (RFC 6749 §5.2):