[java-centralized-discovery COMMIT] in /branches/REL_1: doc/RELEASE-NOTES.txt pom.xml src/main/java/edu/internet2/mid...

[noreply at shibboleth.net]

Author: rdw
Date: Sat Mar 24 15:17:37 2012
New Revision: 2221

URL: http://svn.shibboleth.net/view/java-centralized-discovery?rev=2221&view=rev
Log:
SDSJ109  stop using bean:write instead take the string exactly as is and escape it using ESAPI.  Also add extra test on the returnURL from the SP being http or https (this will only matter for compromised metadata).

Rev POM to 1.2.1

Modified:
    branches/REL_1/doc/RELEASE-NOTES.txt
    branches/REL_1/pom.xml
    branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/wayf/DiscoveryServiceHandler.java
    branches/REL_1/src/main/webapp/wayf.jsp

Modified: branches/REL_1/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-centralized-discovery/branches/REL_1/doc/RELEASE-NOTES.txt?rev=2221&r1=2220&r2=2221&view=diff
==============================================================================
--- branches/REL_1/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_1/doc/RELEASE-NOTES.txt Sat Mar 24 15:17:37 2012
@@ -1,4 +1,5 @@
-Changes in Release XXXX
+Changes in Release 1.2.1
+[SDSJ-109] Remove extra escaping in the JSP.  rely entirely on ESAPI (and java.net.URLEncoder.encode where it won't work)
 [SDSJ-108] Inversion of a parameter by overkeen refactorization
 
 Changes in Release 1.2

Modified: branches/REL_1/pom.xml
URL: http://svn.shibboleth.net/view/java-centralized-discovery/branches/REL_1/pom.xml?rev=2221&r1=2220&r2=2221&view=diff
==============================================================================
--- branches/REL_1/pom.xml (original)
+++ branches/REL_1/pom.xml Sat Mar 24 15:17:37 2012
@@ -12,7 +12,7 @@
 
     <groupId>edu.internet2.middleware</groupId>
     <artifactId>shibboleth-discovery-service</artifactId>
-    <version>1.2.0</version>
+    <version>1.2.1</version>
     <!-- We bundle as a jar here, the installer creates the WAR -->
     <packaging>jar</packaging>
 

Modified: branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/wayf/DiscoveryServiceHandler.java
URL: http://svn.shibboleth.net/view/java-centralized-discovery/branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/wayf/DiscoveryServiceHandler.java?rev=2221&r1=2220&r2=2221&view=diff
==============================================================================
--- branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/wayf/DiscoveryServiceHandler.java (original)
+++ branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/wayf/DiscoveryServiceHandler.java Sat Mar 24 15:17:37 2012
@@ -474,6 +474,12 @@
                 throw new WayfException("Couldn't parse provided return name " + nameNoParam, e);
             }
 
+            String protocol = providedReturnURL.getProtocol();
+
+            if (!"http".equals(protocol) && !"https".equals(protocol)) {
+                throw new WayfException("Return address contained invalid protocol " + protocol);
+            }
+
             for (DiscoveryResponse disc : discoveryServices) {
                 if (equalsURL(disc, providedReturnURL)) {
                     found = true;

Modified: branches/REL_1/src/main/webapp/wayf.jsp
URL: http://svn.shibboleth.net/view/java-centralized-discovery/branches/REL_1/src/main/webapp/wayf.jsp?rev=2221&r1=2220&r2=2221&view=diff
==============================================================================
--- branches/REL_1/src/main/webapp/wayf.jsp (original)
+++ branches/REL_1/src/main/webapp/wayf.jsp Sat Mar 24 15:17:37 2012
@@ -12,6 +12,22 @@
 <%request.setCharacterEncoding("UTF-8");%>
 <%response.setCharacterEncoding("UTF-8");%>
 
+<%! String doEncode(Object what) throws java.io.UnsupportedEncodingException { 
+    return java.net.URLEncoder.encode(what.toString(), "utf-8");
+} 
+%>
+<%
+Object requestURL = request.getAttribute("requestURL");
+
+Object shire = request.getAttribute("shire");
+Object target = request.getAttribute("target");
+Object providerId = request.getAttribute("providerId");
+Object time = request.getAttribute("time");
+
+Object entityID = request.getAttribute("entityID");
+Object returnX =  request.getAttribute("returnX");
+Object returnIDParam = request.getAttribute("returnIDParam");
+%>
 
 <logic:present name="showComments" scope="Request">
 
@@ -31,8 +47,6 @@
      the WAYF and error reporting -->
 
 </logic:present>
-
-    <jsp:useBean id="requestURL" scope="request" class="java.lang.String"/>
 
 <logic:present name="showComments" scope="Request">
 
@@ -185,21 +199,14 @@
         <logic:iterate id="site" name="cookieList">
             <p  class="text">
               <logic:present name="entityID" scope="request">
-                <bean:define id="returnIDParam" name="returnIDParam"/>
-                <bean:define id="ei" name="entityID" />
-                <bean:define id="re" name="returnX"/>
-
-                 <a tabindex="10" href="
-<esapi:encodeForHTMLAttribute><bean:write name="requestURL" />

[... 203 lines stripped ...]