[java-identity-provider] branch maint-3.4 updated: IDP-1472 explicitly warn on bad attribute names

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch maint-3.4
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f626592025bf1c8cede9df24cbe84d32e3fd503a

The following commit(s) were added to refs/heads/maint-3.4 by this push:
       new  f626592   IDP-1472 explicitly warn on bad attribute names
f626592 is described below

commit f626592025bf1c8cede9df24cbe84d32e3fd503a
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Fri Sep 6 11:32:46 2019 +0100

    IDP-1472 explicitly warn on bad attribute names
    
    https://issues.shibboleth.net/jira/browse/IDP-1472
    
    in addition to non printers we now warn on single quotes,  [curly] brackets and percent
---
 .../resolver/AbstractAttributeDefinition.java      | 34 +++++++++++++++++-----
 .../resolver/AbstractAttributeDefinitionTest.java  |  8 +++++
 2 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/idp-attribute-resolver-api/src/main/java/net/shibboleth/idp/attribute/resolver/AbstractAttributeDefinition.java b/idp-attribute-resolver-api/src/main/java/net/shibboleth/idp/attribute/resolver/AbstractAttributeDefinition.java
index df1eb8e..9b3f757 100644
--- a/idp-attribute-resolver-api/src/main/java/net/shibboleth/idp/attribute/resolver/AbstractAttributeDefinition.java
+++ b/idp-attribute-resolver-api/src/main/java/net/shibboleth/idp/attribute/resolver/AbstractAttributeDefinition.java
@@ -30,6 +30,13 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.annotation.concurrent.ThreadSafe;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.google.common.base.Predicates;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
+
 import net.shibboleth.idp.attribute.AttributeEncoder;
 import net.shibboleth.idp.attribute.IdPAttribute;
 import net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext;
@@ -45,14 +52,6 @@ import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
 import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.util.PatternMatchUtils;
-
-import com.google.common.base.Predicates;
-import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.ImmutableSet;
-
 /** Base class for attribute definition resolver plugins. */
 @ThreadSafe
 public abstract class AbstractAttributeDefinition extends AbstractResolverPlugin<IdPAttribute> implements
@@ -209,6 +208,18 @@ public abstract class AbstractAttributeDefinition extends AbstractResolverPlugin
         sourceAttributeID = StringSupport.trimOrNull(attributeId);
     }
 
+    /** Detect whether the attribute contains 'bad characters'.
+     * @return if the name is deprecated
+     */
+    private boolean hasDeprecatedId() {
+        @NotEmpty final String id = StringSupport.trimOrNull(getId());
+        return id == null ||
+                id.indexOf('\'') >= 0 ||
+                id.indexOf('%') >= 0 ||
+                id.indexOf('{') >= 0 ||
+                id.indexOf('}') >= 0;
+    }
+
     /** {@inheritDoc} */
     @Override
     protected void doInitialize() throws ComponentInitializationException {
@@ -237,6 +248,13 @@ public abstract class AbstractAttributeDefinition extends AbstractResolverPlugin
                     null);
             
         }
+        if (hasDeprecatedId()) {
+            DeprecationSupport.warnOnce(ObjectType.CONFIGURATION,
+                    "Use of IdP Attributes names with with special characters (\\'\\\"%{})", 
+                    getLogPrefix(), 
+                    null);
+            log.debug("{} - deprecated character in attribute name", getId());
+        }
     }
 
     /**
diff --git a/idp-attribute-resolver-api/src/test/java/net/shibboleth/idp/attribute/resolver/AbstractAttributeDefinitionTest.java b/idp-attribute-resolver-api/src/test/java/net/shibboleth/idp/attribute/resolver/AbstractAttributeDefinitionTest.java
index 43a6f0a..b201794 100644
--- a/idp-attribute-resolver-api/src/test/java/net/shibboleth/idp/attribute/resolver/AbstractAttributeDefinitionTest.java
+++ b/idp-attribute-resolver-api/src/test/java/net/shibboleth/idp/attribute/resolver/AbstractAttributeDefinitionTest.java
@@ -220,6 +220,14 @@ public class AbstractAttributeDefinitionTest {
         definition.initialize();
         definition = new MockAttributeDefinition("Name\rWith\tnonprinters", (IdPAttribute) null);
         definition.initialize();
+        definition = new MockAttributeDefinition("Namebad1\'", (IdPAttribute) null);
+        definition.initialize();
+        definition = new MockAttributeDefinition("Namebad2%", (IdPAttribute) null);
+        definition.initialize();
+        definition = new MockAttributeDefinition("Namebad3{", (IdPAttribute) null);
+        definition.initialize();
+        definition = new MockAttributeDefinition("Namebad4}", (IdPAttribute) null);
+        definition.initialize();
     }
     
     @Test public void initDestroyValidate() throws ComponentInitializationException {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.