[java-opensaml COMMIT] in /trunk/opensaml-saml-api/src: main/java/org/opensaml/saml/common/messaging/SAMLMessageSecur...

[noreply at shibboleth.net]

Author: putmanb
Date: Sun Oct 16 19:44:10 2016
New Revision: 4538

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4538&view=rev
Log:
OSJ-147: Case-sensitive comparison of setAllowedBindingURLSchemes

Added:
    trunk/opensaml-saml-api/src/test/java/org/opensaml/saml/common/messaging/
    trunk/opensaml-saml-api/src/test/java/org/opensaml/saml/common/messaging/SAMLMessageSecuritySupportTest.java   (with props)
    trunk/opensaml-saml-api/src/test/java/org/opensaml/saml/config/
    trunk/opensaml-saml-api/src/test/java/org/opensaml/saml/config/SAMLConfigurationTest.java   (with props)
Modified:
    trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/SAMLMessageSecuritySupport.java
    trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java

Modified: trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/SAMLMessageSecuritySupport.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/SAMLMessageSecuritySupport.java?rev=4538&r1=4537&r2=4538&view=diff
==============================================================================
--- trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/SAMLMessageSecuritySupport.java	(original)
+++ trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/SAMLMessageSecuritySupport.java	Sun Oct 16 19:44:10 2016
@@ -22,6 +22,7 @@
 
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.messaging.context.MessageContext;
@@ -92,7 +93,12 @@
      * @return true if allowed, otherwise false
      */
     public static boolean checkURLScheme(@Nonnull @NotEmpty String scheme) {
-        return SAMLConfigurationSupport.getAllowedBindingURLSchemes().contains(scheme);
+        String normalized = StringSupport.trimOrNull(scheme);
+        if (normalized == null) {
+            return false;
+        } else {
+            return SAMLConfigurationSupport.getAllowedBindingURLSchemes().contains(normalized.toLowerCase());
+        }
     }
 
 }

Modified: trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java?rev=4538&r1=4537&r2=4538&view=diff
==============================================================================
--- trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java	(original)
+++ trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java	Sun Oct 16 19:44:10 2016
@@ -18,14 +18,27 @@
 package org.opensaml.saml.config;
 
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.joda.time.chrono.ISOChronology;
 import org.joda.time.format.DateTimeFormat;
 import org.joda.time.format.DateTimeFormatter;
 import org.opensaml.saml.saml1.binding.artifact.SAML1ArtifactBuilderFactory;
 import org.opensaml.saml.saml2.binding.artifact.SAML2ArtifactBuilderFactory;
+
+import com.google.common.base.Function;
+import com.google.common.collect.Collections2;
+import com.google.common.collect.Lists;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
 /**
  * SAML-related configuration information.
@@ -37,6 +50,9 @@
  * 
  */
 public class SAMLConfiguration {
+    
+    /** Lowercase string function. */
+    private static Function<String, String> lowercaseFunction = new LowercaseFunction();
 
     /** Date format in SAML object, default is yyyy-MM-dd'T'HH:mm:ss.SSS'Z'. */
     private static String defaultDateFormat = "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'";
@@ -60,10 +76,7 @@
      *
      */
     public SAMLConfiguration() {
-        ArrayList<String> schemes = new ArrayList<>();
-        schemes.add("http");
-        schemes.add("https");
-        setAllowedBindingURLSchemes(schemes);
+        setAllowedBindingURLSchemes(Lists.newArrayList("http", "https"));
     }
 
     /**
@@ -132,17 +145,29 @@
 
     /**
      * Gets the unmodifiable list of schemes allowed to appear in binding URLs when encoding a message. 
+     * 
+     * <p>
+     * All scheme values returned will be lowercased.
+     * </p>
+     * 
+     * <p>
      * Defaults to 'http' and 'https'.
+     * </p>
      * 
      * @return list of URL schemes allowed to appear in a message
      */
+    @Nonnull @NonnullElements @Unmodifiable @NotLive
     public List<String> getAllowedBindingURLSchemes() {

[... 47 lines stripped ...]