From 8f9ee5d1d9e5dc9c357e4cea6bd20eda379500c0 Mon Sep 17 00:00:00 2001
From: William Denniss <wdenniss@google.com>
Date: Fri, 31 May 2019 17:22:04 -0700
Subject: [PATCH] Error when the JSON object isn't a NSDictionary

---
 Source/OIDServiceDiscovery.m         |  7 +++++++
 UnitTests/OIDServiceDiscoveryTests.m | 16 ++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/Source/OIDServiceDiscovery.m b/Source/OIDServiceDiscovery.m
index ca9628ef1..bbd11d738 100644
--- a/Source/OIDServiceDiscovery.m
+++ b/Source/OIDServiceDiscovery.m
@@ -93,6 +93,13 @@ - (nullable instancetype)initWithJSONData:(NSData *)serviceDiscoveryJSONData
                                   description:jsonError.localizedDescription];
     return nil;
   }
+  if (![json isKindOfClass:[NSDictionary class]]) {
+    *error = [OIDErrorUtilities errorWithCode:OIDErrorCodeInvalidDiscoveryDocument
+                              underlyingError:nil
+                                  description:@"Discovery document isn't a dictionary"];
+    return nil;
+  }
+
   return [self initWithDictionary:json error:error];
 }
 
diff --git a/UnitTests/OIDServiceDiscoveryTests.m b/UnitTests/OIDServiceDiscoveryTests.m
index 3610c1e78..f030019ce 100644
--- a/UnitTests/OIDServiceDiscoveryTests.m
+++ b/UnitTests/OIDServiceDiscoveryTests.m
@@ -188,6 +188,10 @@ + (NSURL *)googleDiscoveryAuthorizationEndpoint {
       "ail_verified\",\"exp\",\"family_name\",\"given_name\",\"iat\",\"iss\",\"locale\",\"name\",\""
       "picture\",\"sub\"]}";
 
+static NSString *const kDiscoveryDocumentNotDictionary =
+    @"[\"code\",\"token\",\"id_token\",\"code token\",\"code id_token\",\"token id_token\",\"code to"
+    "ken id_token\",\"none\"]";
+
 /*! @brief Tests that URLs are handled properly when converted from the dictionary's string
         representation.
  */
@@ -222,6 +226,18 @@ - (void)testErrorWhenBadFormat {
   XCTAssertEqual(error.code, OIDErrorCodeJSONDeserializationError, @"");
 }
 
+/*! @brief Tests that we get an error when the root JSON object isn't a dictionary.
+ */
+- (void)testErrorWhenRootObjectNotNSDictionary {
+  NSError *error;
+  OIDServiceDiscovery *discovery = [[OIDServiceDiscovery alloc] initWithJSON:kDiscoveryDocumentNotDictionary error:&error];
+  XCTAssertNil(discovery, @"When initializing a discovery document, it should not return an "
+               "instance if the root JSON object is not a NSDictionary.");
+  XCTAssertNotNil(error, @"There should be an error indicating we received bad JSON.");
+  XCTAssertEqualObjects(error.domain, OIDGeneralErrorDomain, @"");
+  XCTAssertEqual(error.code, OIDErrorCodeInvalidDiscoveryDocument, @"");
+}
+
 /*! @brief Tests that we get an error when the required fields aren't in the source dictionary.
  */
 - (void)testErrorWhenMissingFields {