[java-opensaml2 COMMIT] in /branches/REL_2: doc/RELEASE-NOTES.txt src/main/java/org/opensaml/saml2/core/validator/Req...

[noreply at shibboleth.net]

Author: putmanb
Date: Wed Oct 23 20:34:14 2013
New Revision: 1653

URL: http://svn.shibboleth.net/view/java-opensaml2?rev=1653&view=rev
Log:
JOST-215: Opensaml1 failed to pass veracode due Use of Wrong Operator in String Comparison (CWE ID 597) 

Modified:
    branches/REL_2/doc/RELEASE-NOTES.txt
    branches/REL_2/src/main/java/org/opensaml/saml2/core/validator/RequestAbstractTypeSchemaValidator.java
    branches/REL_2/src/main/java/org/opensaml/saml2/core/validator/StatusResponseTypeSchemaValidator.java

Modified: branches/REL_2/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/doc/RELEASE-NOTES.txt?rev=1653&r1=1652&r2=1653&view=diff
==============================================================================
--- branches/REL_2/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_2/doc/RELEASE-NOTES.txt Wed Oct 23 20:34:14 2013
@@ -2,6 +2,7 @@
 =============================================
 [JOST-210] - AbstractSAMLObject should not override equals but not hashCode
 [JOST-213] - Scoping class has incorrect xsi:type 
+[JOST-215] - Opensaml1 failed to pass veracode due Use of Wrong Operator in String Comparison (CWE ID 597) 
 
 Changes in Release 2.6.0
 =============================================

Modified: branches/REL_2/src/main/java/org/opensaml/saml2/core/validator/RequestAbstractTypeSchemaValidator.java
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/src/main/java/org/opensaml/saml2/core/validator/RequestAbstractTypeSchemaValidator.java?rev=1653&r1=1652&r2=1653&view=diff
==============================================================================
--- branches/REL_2/src/main/java/org/opensaml/saml2/core/validator/RequestAbstractTypeSchemaValidator.java (original)
+++ branches/REL_2/src/main/java/org/opensaml/saml2/core/validator/RequestAbstractTypeSchemaValidator.java Wed Oct 23 20:34:14 2013
@@ -71,7 +71,7 @@
         if (request.getVersion() == null) {
             throw new ValidationException("Version attribute must not be null");
         }
-        if (request.getVersion().toString() != SAMLVersion.VERSION_20.toString()) {
+        if (!DatatypeHelper.safeEquals(request.getVersion().toString(), SAMLVersion.VERSION_20.toString())) {
             throw new ValidationException("Wrong SAML Version");
         }
     }

Modified: branches/REL_2/src/main/java/org/opensaml/saml2/core/validator/StatusResponseTypeSchemaValidator.java
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/src/main/java/org/opensaml/saml2/core/validator/StatusResponseTypeSchemaValidator.java?rev=1653&r1=1652&r2=1653&view=diff
==============================================================================
--- branches/REL_2/src/main/java/org/opensaml/saml2/core/validator/StatusResponseTypeSchemaValidator.java (original)
+++ branches/REL_2/src/main/java/org/opensaml/saml2/core/validator/StatusResponseTypeSchemaValidator.java Wed Oct 23 20:34:14 2013
@@ -79,7 +79,7 @@
     protected void validateVersion(StatusResponse response) throws ValidationException {
         if (response.getVersion() == null)
             throw new ValidationException("Version attribute must not be null");
-        if (response.getVersion().toString() != SAMLVersion.VERSION_20.toString())
+        if (!DatatypeHelper.safeEquals(response.getVersion().toString(), SAMLVersion.VERSION_20.toString()))
             throw new ValidationException("Wrong SAML Version");
     }