[java-opensaml2 COMMIT] in /branches/REL_2: doc/RELEASE-NOTES.txt src/main/java/org/opensaml/saml2/metadata/provider/...

[noreply at shibboleth.net]

Author: lajoie
Date: Sat Oct  8 18:15:28 2011
New Revision: 1550

URL: http://svn.shibboleth.net/view/java-opensaml2?rev=1550&view=rev
Log:
Check that min refresh is less than max refresh in the initialize method in order to prevent case where min refresh is set first and its value is greater than the default value for max refresh delay - JOST-164

Modified:
    branches/REL_2/doc/RELEASE-NOTES.txt
    branches/REL_2/src/main/java/org/opensaml/saml2/metadata/provider/AbstractReloadingMetadataProvider.java

Modified: branches/REL_2/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/doc/RELEASE-NOTES.txt?rev=1550&r1=1549&r2=1550&view=diff
==============================================================================
--- branches/REL_2/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_2/doc/RELEASE-NOTES.txt Sat Oct  8 18:15:28 2011
@@ -1,3 +1,11 @@
+Changes in Release 2.5.2
+=============================================
+[JOST-164] - MetadataProvider minRefreshDelay cannot be set greater than 4 hours
+
+Changes in Release 2.5.1
+=============================================
+ - Addressed a signature wrapping attack
+
 Changes in Release 2.5.0
 =============================================
 [JOST-119] - change pom to create attached -sources jar

Modified: branches/REL_2/src/main/java/org/opensaml/saml2/metadata/provider/AbstractReloadingMetadataProvider.java
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/src/main/java/org/opensaml/saml2/metadata/provider/AbstractReloadingMetadataProvider.java?rev=1550&r1=1549&r2=1550&view=diff
==============================================================================
--- branches/REL_2/src/main/java/org/opensaml/saml2/metadata/provider/AbstractReloadingMetadataProvider.java (original)
+++ branches/REL_2/src/main/java/org/opensaml/saml2/metadata/provider/AbstractReloadingMetadataProvider.java Sat Oct  8 18:15:28 2011
@@ -156,10 +156,6 @@
         if (delay < 0) {
             throw new IllegalArgumentException("Maximum refresh delay must be greater than 0");
         }
-        if (delay < minRefreshDelay) {
-            throw new IllegalArgumentException(
-                    "Maximum refresh delay must be greater than or equal to minimum refresh delay");
-        }
         maxRefreshDelay = delay;
     }
 
@@ -203,10 +199,6 @@
         if (delay < 0) {
             throw new IllegalArgumentException("Minimum refresh delay must be greater than 0");
         }
-        if (delay > maxRefreshDelay) {
-            throw new IllegalArgumentException(
-                    "Minimum refresh delay must be less than or equal to maximum refresh delay");
-        }
         minRefreshDelay = delay;
     }
 
@@ -218,6 +210,11 @@
     /** {@inheritDoc} */
     protected void doInitialization() throws MetadataProviderException {
         refresh();
+
+        if (minRefreshDelay > maxRefreshDelay) {
+            throw new MetadataProviderException("Minimum refresh delay " + minRefreshDelay
+                    + " is greater than maximum refresh delay " + maxRefreshDelay);
+        }
     }
 
     /**
@@ -298,8 +295,9 @@
     protected void processCachedMetadata(String metadataIdentifier, DateTime refreshStart)
             throws MetadataProviderException {
         log.debug("Computing new expiration time for cached metadata from '{}", metadataIdentifier);
-        DateTime metadataExpirationTime = SAML2Helper.getEarliestExpiration(cachedMetadata, refreshStart
-                .plus(getMaxRefreshDelay()), refreshStart);
+        DateTime metadataExpirationTime =
+                SAML2Helper
+                        .getEarliestExpiration(cachedMetadata, refreshStart.plus(getMaxRefreshDelay()), refreshStart);
         log.debug("Expiration of cached metadata from '{}' will occur at {}", metadataIdentifier,
                 metadataExpirationTime.toString());
 
@@ -383,19 +381,19 @@
         postProcessMetadata(metadataBytes, metadataDom, metadata);
 
         log.debug("Computing expiration time for metadata from '{}'", metadataIdentifier);
-        DateTime metadataExpirationTime = SAML2Helper.getEarliestExpiration(metadata, refreshStart
-                .plus(getMaxRefreshDelay()), refreshStart);
-        log.debug("Expiration of metadata from '{}' will occur at {}", metadataIdentifier, metadataExpirationTime
-                .toString());
+        DateTime metadataExpirationTime =
+                SAML2Helper.getEarliestExpiration(metadata, refreshStart.plus(getMaxRefreshDelay()), refreshStart);
+        log.debug("Expiration of metadata from '{}' will occur at {}", metadataIdentifier,
+                metadataExpirationTime.toString());
 
         cachedMetadata = metadata;
         lastUpdate = refreshStart;
-        
+
         long nextRefreshDelay;
-        if(metadataExpirationTime.isBeforeNow()){
+        if (metadataExpirationTime.isBeforeNow()) {
             expirationTime = new DateTime(ISOChronology.getInstanceUTC()).plus(getMinRefreshDelay());
             nextRefreshDelay = getMaxRefreshDelay();
-        }else{
+        } else {

[... 4 lines stripped ...]