[java-opensaml COMMIT] in /trunk: opensaml-messaging-api/src/main/java/org/opensaml/messaging/decoder/servlet/BaseHtt...

[noreply at shibboleth.net]

Author: putmanb
Date: Wed Oct 19 22:17:49 2016
New Revision: 4545

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4545&view=rev
Log:
OSJ-155: Consider changes to decoders vis-a-vis Content-Type header eval

Basic validation hook in base servlet decoder.
Validation for 'text/xml' in HTTP SOAP 1.1 decoder impl.

Modified:
    trunk/opensaml-messaging-api/src/main/java/org/opensaml/messaging/decoder/servlet/BaseHttpServletRequestXMLMessageDecoder.java
    trunk/opensaml-soap-impl/src/main/java/org/opensaml/soap/soap11/decoder/http/impl/HTTPSOAP11Decoder.java
    trunk/opensaml-soap-impl/src/test/java/org/opensaml/soap/soap11/decoder/http/impl/HTTPSOAP11DecoderTest.java

Modified: trunk/opensaml-messaging-api/src/main/java/org/opensaml/messaging/decoder/servlet/BaseHttpServletRequestXMLMessageDecoder.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-messaging-api/src/main/java/org/opensaml/messaging/decoder/servlet/BaseHttpServletRequestXMLMessageDecoder.java?rev=4545&r1=4544&r2=4545&view=diff
==============================================================================
--- trunk/opensaml-messaging-api/src/main/java/org/opensaml/messaging/decoder/servlet/BaseHttpServletRequestXMLMessageDecoder.java	(original)
+++ trunk/opensaml-messaging-api/src/main/java/org/opensaml/messaging/decoder/servlet/BaseHttpServletRequestXMLMessageDecoder.java	Wed Oct 19 22:17:49 2016
@@ -20,6 +20,7 @@
 import java.io.InputStream;
 
 import javax.annotation.Nonnull;
+import javax.servlet.http.HttpServletRequest;
 
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -32,6 +33,7 @@
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
+import org.opensaml.messaging.decoder.MessageDecoder;
 import org.opensaml.messaging.decoder.MessageDecodingException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -64,6 +66,8 @@
         log.debug("Beginning to decode message from HttpServletRequest");
         
         log.debug("HttpServletRequest indicated Content-Type: {}", getHttpServletRequest().getContentType());
+        
+        validateHttpRequest(getHttpServletRequest());
         
         super.decode();
         
@@ -157,5 +161,22 @@
             throw new MessageDecodingException("Error unmarshalling message from input stream", e);
         }
     }
+    
+    /**
+     * Perform optional validation of the inbound {@link HttpServletRequest}.
+     * 
+     * <p>
+     * This method is called before the main {@link MessageDecoder#decode()} logic}.
+     * </p>
+     * 
+     * <p>
+     * The default behavior is a no-op.  Subclasses may override with specific constraints.
+     * </p>
+     * 
+     * @param request
+     */
+    protected void validateHttpRequest(HttpServletRequest request) throws MessageDecodingException {
+        // Default is no-op
+    }
 
 }

Modified: trunk/opensaml-soap-impl/src/main/java/org/opensaml/soap/soap11/decoder/http/impl/HTTPSOAP11Decoder.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-soap-impl/src/main/java/org/opensaml/soap/soap11/decoder/http/impl/HTTPSOAP11Decoder.java?rev=4545&r1=4544&r2=4545&view=diff
==============================================================================
--- trunk/opensaml-soap-impl/src/main/java/org/opensaml/soap/soap11/decoder/http/impl/HTTPSOAP11Decoder.java	(original)
+++ trunk/opensaml-soap-impl/src/main/java/org/opensaml/soap/soap11/decoder/http/impl/HTTPSOAP11Decoder.java	Wed Oct 19 22:17:49 2016
@@ -18,10 +18,9 @@
 package org.opensaml.soap.soap11.decoder.http.impl;
 
 import java.io.IOException;
+import java.util.Set;
 
 import javax.servlet.http.HttpServletRequest;
-
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.messaging.context.MessageContext;
@@ -33,6 +32,12 @@
 import org.opensaml.soap.soap11.Envelope;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+
+import com.google.common.collect.Sets;
+import com.google.common.net.MediaType;
+
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
 
 /**
  * Basic SOAP 1.1 decoder for HTTP transport.
@@ -53,6 +58,9 @@
 public class HTTPSOAP11Decoder<MessageType extends XMLObject> 
     extends BaseHttpServletRequestXMLMessageDecoder<MessageType> {
 
+    /** Valid Content-Type media types. */
+    private static final Set<MediaType> SUPPORTED_MEDIA_TYPES = Sets.newHashSet(MediaType.create("text", "xml"));
+    
     /** Class logger. */
     private final Logger log = LoggerFactory.getLogger(HTTPSOAP11Decoder.class);
     
@@ -129,4 +137,17 @@
         return getMessageContext().getSubcontext(SOAP11Context.class, true).getEnvelope();
     }
 
+    /** {@inheritDoc} */
+    @Override

[... 79 lines stripped ...]