HTTPRequest send method error response does not use UTF-8 character decoding

[Andreas Blakli]

The method HTTPResponse send() in src/main/java/com/nimbusds/oauth2/sdk/http/HTTPRequest.java does not explicitly decode the error responses with UTF-8 which causes issues if the error response contains characters like ‘ÆØÅ’ and the locale in the environment where the JVM runs is not UTF-8.

How to replicate:

• JVM with ANSI_X3.4-1968 as locale. (Can be forced through VM options i.e. ‘-Dfile.encoding=ANSI_X3.4-1968’)
• Get error response which contains the character ‘Ø'

Expected output: ��

Solution:

• Add StandardCharsets.UTF_8 to InputStreamReader() on line 1038 in src/main/java/com/nimbusds/oauth2/sdk/http/HTTPRequest.java (https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/f65504ca4d8b52c42031350dac8ba916f5f4806b/src/main/java/com/nimbusds/oauth2/sdk/http/HTTPRequest.java#lines-1038)

‌

[Yavor Vasilev]

Fixed here: 01b908da

Released:

version 10.9.2 (2023-06-21)
    * HTTPResponse.send must read error responses from InputStreamReader using
      UTF-8 character encoding (iss #426).

Thanks for the report and solution!