LTI 1.3 Mismatching LTI Tools with NRPS services and oauth_consumer_key_sign

[erikgoreact]

We have reported these two issues on the opensource repo tracker, but have gotten zero information or responses on them.

Today, canvas will fail to handle the NRPS service in a migrated 1.1 assignment as it tries to use the wrong tool consumer and throws an error.

The same thing happens with oauth_consumer_key_sign. Becuase of their "domain matching" logic, they can find the wrong tool since they just order a list of all tools with matching domains.

Anyone know how to get canvas to look at this or notice? Its technically a security issue as it thinks a tool is actually a different tool.

https://github.com/instructure/canvas-lms/issues/2289
https://github.com/instructure/canvas-lms/issues/2287