[java-opensaml] branch master updated: OSJ-243: HTTPRedirectDeflateEncoder removes all query parameter ...
Brent Putman
putmanb at georgetown.edu
Fri Jun 29 21:13:27 EDT 2018
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=87535dbcf175ed115ae67f61192223d199428543
The following commit(s) were added to refs/heads/master by this push:
new 87535db OSJ-243: HTTPRedirectDeflateEncoder removes all query parameter ...
87535db is described below
commit 87535dbcf175ed115ae67f61192223d199428543
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Jun 29 21:10:29 2018 -0400
OSJ-243: HTTPRedirectDeflateEncoder removes all query parameter ...
---
.../encoding/impl/HTTPRedirectDeflateEncoder.java | 28 ++++-
.../impl/HTTPRedirectDeflateEncoderTest.java | 129 +++++++++++++++++++++
2 files changed, 156 insertions(+), 1 deletion(-)
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoder.java
index 9b58aba..09ebb70 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoder.java
@@ -21,16 +21,20 @@ import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.MalformedURLException;
+import java.util.Iterator;
import java.util.List;
+import java.util.Set;
import java.util.zip.Deflater;
import java.util.zip.DeflaterOutputStream;
+import javax.annotation.Nonnull;
import javax.servlet.http.HttpServletResponse;
import net.shibboleth.utilities.java.support.codec.Base64Support;
import net.shibboleth.utilities.java.support.collection.Pair;
import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.net.URLBuilder;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.xml.SerializeSupport;
import org.opensaml.messaging.context.MessageContext;
@@ -50,12 +54,18 @@ import org.opensaml.xmlsec.crypto.XMLSigningUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import com.google.common.collect.Sets;
+
/**
* SAML 2.0 HTTP Redirect encoder using the DEFLATE encoding method.
*
* This encoder only supports DEFLATE compression.
*/
public class HTTPRedirectDeflateEncoder extends BaseSAML2MessageEncoder {
+
+ /** Params which are disallowed from appearing in the input endpoint URL. */
+ private static final Set<String> DISALLOWED_ENDPOINT_QUERY_PARAMS =
+ Sets.newHashSet("SAMLEncoding", "SAMLRequest", "SAMLResponse", "RelayState", "SigAlg", "Signature");
/** Class logger. */
private final Logger log = LoggerFactory.getLogger(HTTPRedirectDeflateEncoder.class);
@@ -159,7 +169,7 @@ public class HTTPRedirectDeflateEncoder extends BaseSAML2MessageEncoder {
}
final List<Pair<String, String>> queryParams = urlBuilder.getQueryParams();
- queryParams.clear();
+ removeDisallowedQueryParams(queryParams);
final SAMLObject outboundMessage = messageContext.getMessage();
@@ -195,6 +205,22 @@ public class HTTPRedirectDeflateEncoder extends BaseSAML2MessageEncoder {
}
/**
+ * Remove disallowed query params from the supplied list.
+ *
+ * @param queryParams the list of query params on which to operate
+ */
+ protected void removeDisallowedQueryParams(final @Nonnull List<Pair<String, String>> queryParams) {
+ final Iterator<Pair<String,String>> iter = queryParams.iterator();
+ while (iter.hasNext()) {
+ final String paramName = StringSupport.trimOrNull(iter.next().getFirst());
+ if (DISALLOWED_ENDPOINT_QUERY_PARAMS.contains(paramName)) {
+ log.debug("Removing disallowed query param '{}' from endpoint URL", paramName);
+ iter.remove();
+ }
+ }
+ }
+
+ /**
* Gets the signature algorithm URI to use.
*
* @param signingParameters the signing parameters to use
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoderTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoderTest.java
index afcd462..9065547 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoderTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoderTest.java
@@ -114,6 +114,135 @@ public class HTTPRedirectDeflateEncoderTest extends XMLObjectBaseTestCase {
}
/**
+ * Tests encoding a SAML message to an servlet response.
+ *
+ * @throws Exception
+ */
+ @Test
+ @SuppressWarnings("unchecked")
+ public void testResponseEncodingWithEndpointQueryParams() throws Exception {
+ SAMLObjectBuilder<StatusCode> statusCodeBuilder = (SAMLObjectBuilder<StatusCode>) builderFactory
+ .getBuilder(StatusCode.DEFAULT_ELEMENT_NAME);
+ StatusCode statusCode = statusCodeBuilder.buildObject();
+ statusCode.setValue(StatusCode.SUCCESS);
+
+ SAMLObjectBuilder<Status> statusBuilder = (SAMLObjectBuilder<Status>) builderFactory
+ .getBuilder(Status.DEFAULT_ELEMENT_NAME);
+ Status responseStatus = statusBuilder.buildObject();
+ responseStatus.setStatusCode(statusCode);
+
+ SAMLObjectBuilder<Response> responseBuilder = (SAMLObjectBuilder<Response>) builderFactory
+ .getBuilder(Response.DEFAULT_ELEMENT_NAME);
+ Response samlMessage = responseBuilder.buildObject();
+ samlMessage.setID("foo");
+ samlMessage.setVersion(SAMLVersion.VERSION_20);
+ samlMessage.setIssueInstant(new DateTime(0));
+ samlMessage.setStatus(responseStatus);
+
+ SAMLObjectBuilder<Endpoint> endpointBuilder = (SAMLObjectBuilder<Endpoint>) builderFactory
+ .getBuilder(AssertionConsumerService.DEFAULT_ELEMENT_NAME);
+ Endpoint samlEndpoint = endpointBuilder.buildObject();
+ samlEndpoint.setLocation("http://example.org");
+ samlEndpoint.setResponseLocation("http://example.org/response?foo=bar&abc=123");
+
+ MessageContext<SAMLObject> messageContext = new MessageContext<>();
+ messageContext.setMessage(samlMessage);
+ SAMLBindingSupport.setRelayState(messageContext, "relay");
+ messageContext.getSubcontext(SAMLPeerEntityContext.class, true)
+ .getSubcontext(SAMLEndpointContext.class, true).setEndpoint(samlEndpoint);
+
+ SAMLOutboundDestinationHandler handler = new SAMLOutboundDestinationHandler();
+ handler.invoke(messageContext);
+
+ MockHttpServletResponse response = new MockHttpServletResponse();
+
+ HTTPRedirectDeflateEncoder encoder = new HTTPRedirectDeflateEncoder();
+ encoder.setMessageContext(messageContext);
+ encoder.setHttpServletResponse(response);
+
+ encoder.initialize();
+ encoder.prepareContext();
+ encoder.encode();
+
+ Assert.assertEquals("UTF-8", response.getCharacterEncoding(), "Unexpected character encoding");
+ Assert.assertEquals(response.getHeader("Cache-control"), "no-cache, no-store", "Unexpected cache controls");
+
+ String queryString = new URI(response.getRedirectedUrl()).getRawQuery();
+
+ Assert.assertEquals(URISupport.getRawQueryStringParameter(queryString, "foo"), "foo=bar");
+ Assert.assertEquals(URISupport.getRawQueryStringParameter(queryString, "abc"), "abc=123");
+ }
+
+ /**
+ * Tests encoding a SAML message to an servlet response.
+ *
+ * @throws Exception
+ */
+ @Test
+ @SuppressWarnings("unchecked")
+ public void testResponseEncodingWithDisallowedEndpointQueryParams() throws Exception {
+ SAMLObjectBuilder<StatusCode> statusCodeBuilder = (SAMLObjectBuilder<StatusCode>) builderFactory
+ .getBuilder(StatusCode.DEFAULT_ELEMENT_NAME);
+ StatusCode statusCode = statusCodeBuilder.buildObject();
+ statusCode.setValue(StatusCode.SUCCESS);
+
+ SAMLObjectBuilder<Status> statusBuilder = (SAMLObjectBuilder<Status>) builderFactory
+ .getBuilder(Status.DEFAULT_ELEMENT_NAME);
+ Status responseStatus = statusBuilder.buildObject();
+ responseStatus.setStatusCode(statusCode);
+
+ SAMLObjectBuilder<Response> responseBuilder = (SAMLObjectBuilder<Response>) builderFactory
+ .getBuilder(Response.DEFAULT_ELEMENT_NAME);
+ Response samlMessage = responseBuilder.buildObject();
+ samlMessage.setID("foo");
+ samlMessage.setVersion(SAMLVersion.VERSION_20);
+ samlMessage.setIssueInstant(new DateTime(0));
+ samlMessage.setStatus(responseStatus);
+
+ SAMLObjectBuilder<Endpoint> endpointBuilder = (SAMLObjectBuilder<Endpoint>) builderFactory
+ .getBuilder(AssertionConsumerService.DEFAULT_ELEMENT_NAME);
+ Endpoint samlEndpoint = endpointBuilder.buildObject();
+ samlEndpoint.setLocation("http://example.org");
+ samlEndpoint.setResponseLocation("http://example.org/response?foo=bar&abc=123&SAMLEncoding=blah&SAMLRequest=blah&SAMLResponse=blah&RelayState=blah&SigAlg=blah&Signature=blah");
+
+ MessageContext<SAMLObject> messageContext = new MessageContext<>();
+ messageContext.setMessage(samlMessage);
+ SAMLBindingSupport.setRelayState(messageContext, "relay");
+ messageContext.getSubcontext(SAMLPeerEntityContext.class, true)
+ .getSubcontext(SAMLEndpointContext.class, true).setEndpoint(samlEndpoint);
+
+ SAMLOutboundDestinationHandler handler = new SAMLOutboundDestinationHandler();
+ handler.invoke(messageContext);
+
+ MockHttpServletResponse response = new MockHttpServletResponse();
+
+ HTTPRedirectDeflateEncoder encoder = new HTTPRedirectDeflateEncoder();
+ encoder.setMessageContext(messageContext);
+ encoder.setHttpServletResponse(response);
+
+ encoder.initialize();
+ encoder.prepareContext();
+ encoder.encode();
+
+ Assert.assertEquals("UTF-8", response.getCharacterEncoding(), "Unexpected character encoding");
+ Assert.assertEquals(response.getHeader("Cache-control"), "no-cache, no-store", "Unexpected cache controls");
+
+ String queryString = new URI(response.getRedirectedUrl()).getRawQuery();
+
+ Assert.assertEquals(URISupport.getRawQueryStringParameter(queryString, "foo"), "foo=bar");
+ Assert.assertEquals(URISupport.getRawQueryStringParameter(queryString, "abc"), "abc=123");
+ Assert.assertEquals(URISupport.getRawQueryStringParameter(queryString, "RelayState"), "RelayState=relay");
+ Assert.assertNotNull(URISupport.getRawQueryStringParameter(queryString, "SAMLResponse"));
+ Assert.assertNotEquals(URISupport.getRawQueryStringParameter(queryString, "SAMLResponse"), "blah");
+ Assert.assertFalse(queryString.contains("SAMLResponse=blah"));
+
+ Assert.assertNull(URISupport.getRawQueryStringParameter(queryString, "SAMLEncoding"));
+ Assert.assertNull(URISupport.getRawQueryStringParameter(queryString, "SAMLRequest"));
+ Assert.assertNull(URISupport.getRawQueryStringParameter(queryString, "SigAlg"));
+ Assert.assertNull(URISupport.getRawQueryStringParameter(queryString, "Signature"));
+ }
+
+ /**
* Tests encoding a SAML message to an servlet response with simple sign.
*
* @throws Exception
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list