[java-identity-provider] branch master updated: IDP-1191 - Add XSRF mitigation to form processing actions
Scott Cantor
cantor.2 at osu.edu
Mon Dec 2 12:47:50 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=94fb7c41ee1f2c33b1b699b699967b783a99d833
The following commit(s) were added to refs/heads/master by this push:
new 94fb7c4 IDP-1191 - Add XSRF mitigation to form processing actions
94fb7c4 is described below
commit 94fb7c41ee1f2c33b1b699b699967b783a99d833
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Dec 2 12:47:47 2019 -0500
IDP-1191 - Add XSRF mitigation to form processing actions
https://issues.shibboleth.net/jira/browse/IDP-1191
Move Velocity CSRF boilerplate into parsed system view.
Remove id attribute from element to avoid duplication.
---
.../src/main/resources/system/views/client-storage/read.vm | 4 +---
.../main/resources/system/views/client-storage/write.vm | 4 +---
idp-conf/src/main/resources/system/views/csrf/csrf.vm | 6 ++++++
idp-conf/src/main/resources/views/admin/unlock-keys.vm | 11 +++++------
idp-conf/src/main/resources/views/duo.vm | 5 +----
.../main/resources/views/intercept/attribute-release.vm | 4 +---
idp-conf/src/main/resources/views/intercept/impersonate.vm | 6 ++----
.../src/main/resources/views/intercept/terms-of-use.vm | 8 ++------
idp-conf/src/main/resources/views/login.vm | 14 ++++++--------
idp-conf/src/main/resources/views/logout.vm | 2 +-
10 files changed, 26 insertions(+), 38 deletions(-)
diff --git a/idp-conf/src/main/resources/system/views/client-storage/read.vm b/idp-conf/src/main/resources/system/views/client-storage/read.vm
index fc570d7..fc514d6 100644
--- a/idp-conf/src/main/resources/system/views/client-storage/read.vm
+++ b/idp-conf/src/main/resources/system/views/client-storage/read.vm
@@ -16,9 +16,7 @@
## pairing with the doLoad() function that populates the fields.
##
<form name="form1" action="${flowExecutionUrl}" method="post">
- #if (${csrfToken})
- <input type="hidden" name="${csrfToken.parameterName}" value="${csrfToken.token}" id="csrf_token">
- #end
+ #parse("csrf/csrf.vm")
#foreach ($key in $loadContext.getStorageKeys())
<input name="shib_idp_ls_exception.$key" type="hidden" />
<input name="shib_idp_ls_success.$key" type="hidden" value="false" />
diff --git a/idp-conf/src/main/resources/system/views/client-storage/write.vm b/idp-conf/src/main/resources/system/views/client-storage/write.vm
index 8b9cd96..b059100 100644
--- a/idp-conf/src/main/resources/system/views/client-storage/write.vm
+++ b/idp-conf/src/main/resources/system/views/client-storage/write.vm
@@ -17,9 +17,7 @@
## to those fields.
##
<form name="form1" action="${flowExecutionUrl}" method="post">
- #if (${csrfToken})
- <input type="hidden" name="${csrfToken.parameterName}" value="${csrfToken.token}" id="csrf_token">
- #end
+ #parse("csrf/csrf.vm")
#foreach ($op in $saveContext.getStorageOperations())
<input name="shib_idp_ls_exception.$op.getKey()" type="hidden" />
<input name="shib_idp_ls_success.$op.getKey()" type="hidden" value="false" />
diff --git a/idp-conf/src/main/resources/system/views/csrf/csrf.vm b/idp-conf/src/main/resources/system/views/csrf/csrf.vm
new file mode 100644
index 0000000..4f775a7
--- /dev/null
+++ b/idp-conf/src/main/resources/system/views/csrf/csrf.vm
@@ -0,0 +1,6 @@
+##
+## Velocity template to handle form field for CSRF check
+##
+#if (${csrfToken})
+ <input type="hidden" name="${csrfToken.parameterName}" value="${csrfToken.token}" />
+#end
diff --git a/idp-conf/src/main/resources/views/admin/unlock-keys.vm b/idp-conf/src/main/resources/views/admin/unlock-keys.vm
index f519d69..a8228ae 100644
--- a/idp-conf/src/main/resources/views/admin/unlock-keys.vm
+++ b/idp-conf/src/main/resources/views/admin/unlock-keys.vm
@@ -43,9 +43,8 @@
#end
<form action="$flowExecutionUrl" method="post">
- #if (${csrfToken})
- <input type="hidden" name="${csrfToken.parameterName}" value="${csrfToken.token}" id="csrf_token">
- #end
+ #parse("csrf/csrf.vm")
+
<!--
If you have multiple key strategies defined, you'll need multiple pairs of form fields for
the passwords, labeled in the order they're fed into the shibboleth.unlock-keys.KeyStrategies
@@ -54,12 +53,12 @@
<div class="form-element-wrapper">
<label for="password">#springMessageText("idp.unlock-keys.keystorePassword", "DataSealer Keystore Password")</label>
- <input class="form-element form-field" id="password" name="keystorePassword" type="password">
+ <input class="form-element form-field" id="password" name="keystorePassword" type="password" />
</div>
<div class="form-element-wrapper">
<label for="password">#springMessageText("idp.unlock-keys.keyPassword", "DataSealer Key Password")</label>
- <input class="form-element form-field" id="password" name="keyPassword" type="password">
+ <input class="form-element form-field" id="password" name="keyPassword" type="password" />
</div>
<!--
@@ -69,7 +68,7 @@
<div class="form-element-wrapper">
<label for="password">#springMessageText("idp.unlock-keys.privateKeyPassword", "Private Key Password")</label>
- <input class="form-element form-field" id="password" name="privateKeyPassword" type="password">
+ <input class="form-element form-field" id="password" name="privateKeyPassword" type="password" />
</div>
<div class="form-element-wrapper">
diff --git a/idp-conf/src/main/resources/views/duo.vm b/idp-conf/src/main/resources/views/duo.vm
index cfb4307..d212df7 100644
--- a/idp-conf/src/main/resources/views/duo.vm
+++ b/idp-conf/src/main/resources/views/duo.vm
@@ -57,11 +57,8 @@
>
</iframe>
<form id="duo_form" method="post">
- #if (${csrfToken})
- <input type="hidden" name="${csrfToken.parameterName}" value="${csrfToken.token}" id="csrf_token">
- #end
+ #parse("csrf/csrf.vm")
<input type="hidden" name="_eventId" value="proceed" />
-
</form>
<h3 style="text-align: center">
diff --git a/idp-conf/src/main/resources/views/intercept/attribute-release.vm b/idp-conf/src/main/resources/views/intercept/attribute-release.vm
index 9990d92..c170b69 100644
--- a/idp-conf/src/main/resources/views/intercept/attribute-release.vm
+++ b/idp-conf/src/main/resources/views/intercept/attribute-release.vm
@@ -35,9 +35,7 @@
</head>
<body>
<form action="$flowExecutionUrl" method="post" style="padding:10px" >
- #if (${csrfToken})
- <input type="hidden" name="${csrfToken.parameterName}" value="${csrfToken.token}" id="csrf_token">
- #end
+ #parse("csrf/csrf.vm")
<div class="box">
<header>
<img src="$request.getContextPath()#springMessage("idp.logo")" alt="#springMessageText("idp.logo.alt-text", "logo")" class="federation_logo">
diff --git a/idp-conf/src/main/resources/views/intercept/impersonate.vm b/idp-conf/src/main/resources/views/intercept/impersonate.vm
index 5414bcb..37c486c 100644
--- a/idp-conf/src/main/resources/views/intercept/impersonate.vm
+++ b/idp-conf/src/main/resources/views/intercept/impersonate.vm
@@ -34,9 +34,7 @@
<div class="content">
<form action="$flowExecutionUrl" method="post">
- #if (${csrfToken})
- <input type="hidden" name="${csrfToken.parameterName}" value="${csrfToken.token}" id="csrf_token">
- #end
+ #parse("csrf/csrf.vm")
#set ($serviceName = $rpUIContext.serviceName)
#if ($serviceName && !$rpContext.getRelyingPartyId().contains($serviceName))
<legend>
@@ -50,7 +48,7 @@
<div class="form-element-wrapper">
<label for="impersonation">#springMessageText("idp.impersonate.login-as", "Login as")</label>
- <input class="form-element form-field" id="impersonation" name="principal" type="text">
+ <input class="form-element form-field" id="impersonation" name="principal" type="text" />
<!-- Defaults to input box above, example below populates a select list from an IdPAttribute. -->
<!--
diff --git a/idp-conf/src/main/resources/views/intercept/terms-of-use.vm b/idp-conf/src/main/resources/views/intercept/terms-of-use.vm
index 929890a..67b2c15 100644
--- a/idp-conf/src/main/resources/views/intercept/terms-of-use.vm
+++ b/idp-conf/src/main/resources/views/intercept/terms-of-use.vm
@@ -42,17 +42,13 @@
<div id="tou-acceptance">
<div style="float:left;">
<form action="$flowExecutionUrl" method="post" >
- #if (${csrfToken})
- <input type="hidden" name="${csrfToken.parameterName}" value="${csrfToken.token}" id="csrf_token">
- #end
+ #parse("csrf/csrf.vm")
<input type="submit" name="_eventId_TermsRejected" value="#springMessageText("idp.terms-of-use.reject", "Refuse")" style="margin-right: 30px;">
</form>
</div>
<div style="float:right;">
<form action="$flowExecutionUrl" method="post" >
- #if (${csrfToken})
- <input type="hidden" name="${csrfToken.parameterName}" value="${csrfToken.token}" id="csrf_token">
- #end
+ #parse("csrf/csrf.vm")
<input id="accept" type="checkbox" name="_shib_idp_consentIds" value="$encoder.encodeForHTML($termsOfUseId)" required>
<label for="accept">#springMessageText("idp.terms-of-use.accept", "I accept the terms of use")</label>
#if ($requireCheckbox)
diff --git a/idp-conf/src/main/resources/views/login.vm b/idp-conf/src/main/resources/views/login.vm
index 2403f09..7609d40 100644
--- a/idp-conf/src/main/resources/views/login.vm
+++ b/idp-conf/src/main/resources/views/login.vm
@@ -46,9 +46,7 @@
#parse("login-error.vm")
<form action="$flowExecutionUrl" method="post">
- #if (${csrfToken})
- <input type="hidden" name="${csrfToken.parameterName}" value="${csrfToken.token}" id="csrf_token">
- #end
+ #parse("csrf/csrf.vm")
#set ($serviceName = $rpUIContext.serviceName)
#if ($serviceName && !$rpContext.getRelyingPartyId().contains($serviceName))
<legend>
@@ -60,12 +58,12 @@
<div class="form-element-wrapper">
<label for="username">#springMessageText("idp.login.username", "Username")</label>
<input class="form-element form-field" id="username" name="j_username" type="text"
- value="#if($username)$encoder.encodeForHTML($username)#end">
+ value="#if($username)$encoder.encodeForHTML($username)#end" />
</div>
<div class="form-element-wrapper">
<label for="password">#springMessageText("idp.login.password", "Password")</label>
- <input class="form-element form-field" id="password" name="j_password" type="password" value="">
+ <input class="form-element form-field" id="password" name="j_password" type="password" value="" />
</div>
## You may need to modify this to taste, such as changing the flow name its checking for to authn/MFA.
@@ -79,7 +77,7 @@
#end
<div class="form-element-wrapper">
- <input id="_shib_idp_revokeConsent" type="checkbox" name="_shib_idp_revokeConsent" value="true">
+ <input id="_shib_idp_revokeConsent" type="checkbox" name="_shib_idp_revokeConsent" value="true" />
<label for="_shib_idp_revokeConsent">#springMessageText("idp.attribute-release.revoke", "Clear prior granting of permission for release of your information to this service.")</label>
</div>
@@ -102,7 +100,7 @@
#end
</form>
- #*
+ #*
//
// SP Description & Logo (optional)
// These idpui lines will display added information (if available
@@ -142,5 +140,5 @@
</footer>
</div>
- </body>
+ </body>
</html>
\ No newline at end of file
diff --git a/idp-conf/src/main/resources/views/logout.vm b/idp-conf/src/main/resources/views/logout.vm
index 39fe2fc..0b9103b 100644
--- a/idp-conf/src/main/resources/views/logout.vm
+++ b/idp-conf/src/main/resources/views/logout.vm
@@ -129,5 +129,5 @@
</footer>
</div>
- </body>
+ </body>
</html>
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list