fix: stricter toString conversion for unsupported types

Author: jankapunkt

lib/grant-types/refresh-token-grant-type.js

@@ -75,12 +75,14 @@ class RefreshTokenGrantType extends AbstractGrantType {
       throw new InvalidRequestError('Invalid parameter: `refresh_token`');
     }
 
+    // normalize string|number to string
     const refreshToken = toString(request.body.refresh_token);
 
     if (!isFormat.vschar(refreshToken)) {
       throw new InvalidRequestError('Invalid parameter: `refresh_token`');
     }
 
+    // XXX: still passing the original value from request to model
     const token = await this.model.getRefreshToken(request.body.refresh_token);
 
     if (!token) {

lib/handlers/token-handler.js

@@ -129,7 +129,7 @@ class TokenHandler {
       throw new InvalidRequestError('Invalid parameter: `client_id`');
     }
 
-    if (credentials.clientSecret && !isFormat.vschar(credentials.clientSecret)) {
+    if (credentials.clientSecret && (!isStringOrNumber(credentials.clientSecret) || !isFormat.vschar(toString(credentials.clientSecret)))) {
       throw new InvalidRequestError('Invalid parameter: `client_secret`');
     }
 

lib/utils/param-util.js

@@ -36,19 +36,25 @@ function isDefined (value) {
  * @return {string}
  */
 function toString(value) {
-  if (typeof value === 'string') {
+  const type = typeof value;
+  if (type === 'string') {
     return value;
   }
 
-  if (Object.prototype.hasOwnProperty.call(value, 'toString')) {
-    return value.toString();
+  if (type === 'undefined' || value === null) {
+    throw new TypeError(`Cannot convert ${value} to a string`);
   }
 
-  if (value === null || value === undefined) {
-    return '';
+  if (type === 'number' || type === 'bigint') {
+    const val = String(value);
+    if (val === 'NaN' || val === 'Infinity' || val === '-Infinity') {
+      throw new TypeError(`Invalid numeric value ${value}, cannot be converted to a string (${val})`);
+    }
+    return val;
   }
 
-  return String(value);
+
+  throw new TypeError(`Cannot convert value ${value} of type ${type} to a string`);
 }
 
 module.exports = { isInTypes, isDefined, toString };