[java-opensaml COMMIT] /trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedi...

[noreply at shibboleth.net]

Author: putmanb
Date: Wed Jun 22 18:51:38 2016
New Revision: 4469

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4469&view=rev
Log:
OSJ-166: SAML 2 HTTP-Redirect DEFLATE decoder allows for invalid HTTP methods

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java?rev=4469&r1=4468&r2=4469&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java	(original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java	Wed Jun 22 18:51:38 2016
@@ -84,6 +84,10 @@
     protected void doDecode() throws MessageDecodingException {
         MessageContext<SAMLObject> messageContext = new MessageContext<>();
         HttpServletRequest request = getHttpServletRequest();
+        
+        if (!"GET".equalsIgnoreCase(request.getMethod())) {
+            throw new MessageDecodingException("This message decoder only supports the HTTP GET method");
+        }
 
         String relayState = request.getParameter("RelayState");
         log.debug("Decoded RelayState: {}", relayState);