[java-opensaml COMMIT] /trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArt...

[noreply at shibboleth.net]

Author: putmanb
Date: Wed Oct  5 18:50:35 2016
New Revision: 4514

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4514&view=rev
Log:
When canonicalizing URL to index, also remove query, fragment, and username/password.

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java?rev=4514&r1=4513&r2=4514&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java	(original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java	Wed Oct  5 18:50:35 2016
@@ -61,6 +61,7 @@
 import net.shibboleth.utilities.java.support.collection.LazySet;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.net.SimpleURLCanonicalizer;
+import net.shibboleth.utilities.java.support.net.URLBuilder;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
 
@@ -367,7 +368,7 @@
             location = Constraint.isNotNull(StringSupport.trimOrNull(sourceLocation),
                     "SAML artifact source location cannot be null or empty");
             try {
-                canonicalizedLocation = SimpleURLCanonicalizer.canonicalize(location);
+                canonicalizedLocation = canonicalizeLocation(location);
             } catch (MalformedURLException e) {
                 // This is unlikely to happen on realistic real world inputs. If it does, don't be fatal, 
                 // just switch to alternate strategy.
@@ -436,6 +437,22 @@
             return false;
         }
         
+        /**
+         * Canonicalize the location to be indexed.
+         * 
+         * @param url the location
+         * @return the canonicalized location value to index
+         * @throws MalformedURLException if URL can not be canonicalized
+         */
+        private String canonicalizeLocation(String url) throws MalformedURLException {
+            URLBuilder urlBuilder = new URLBuilder(url);
+            urlBuilder.setUsername(null);
+            urlBuilder.setPassword(null);
+            urlBuilder.getQueryParams().clear();
+            urlBuilder.setFragment(null);
+            return SimpleURLCanonicalizer.canonicalize(urlBuilder.buildURL());
+        }
+        
     }
 
 }