[java-identity-provider] 02/02: IDP-1660 Sort multi-value attributes before hashing them in for consent

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=42512d736b2e6a8b0470f9bdf545fca86c043fd9

commit 42512d736b2e6a8b0470f9bdf545fca86c043fd9
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Dec 10 11:13:16 2020 +0000

    IDP-1660 Sort multi-value attributes before hashing them in for consent
    
    https://issues.shibboleth.net/jira/browse/IDP-1660
    
    Compute the unsorted and the sorted hash and compare both.
    If either work then push this forward.
    
    Order changing test now passes.
---
 .../logic/impl/AttributeReleaseConsentFunction.java      | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributeReleaseConsentFunction.java b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributeReleaseConsentFunction.java
index 98eca7c5e..f91b3ee51 100644
--- a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributeReleaseConsentFunction.java
+++ b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributeReleaseConsentFunction.java
@@ -17,8 +17,11 @@
 
 package net.shibboleth.idp.consent.logic.impl;
 
+import java.util.ArrayList;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.function.Function;
@@ -108,6 +111,7 @@ public class AttributeReleaseConsentFunction implements Function<ProfileRequestC
     }
 
     /** {@inheritDoc} */
+    /// CheckStyle: CyclomaticComplexity OFF
     @Override @Nullable public Map<String, Consent> apply(@Nullable final ProfileRequestContext input) {
         if (input == null) {
             return null;
@@ -134,10 +138,14 @@ public class AttributeReleaseConsentFunction implements Function<ProfileRequestC
         for (final IdPAttribute attribute : consentableAttributes.values()) {
 
             final Consent consent = new Consent();
+            final Consent unsortedConsent = new Consent();
             consent.setId(attribute.getId());
 
             if (consentFlowDescriptor.compareValues()) {
-                consent.setValue(attributeValuesHashFunction.apply(attribute.getValues()));
+                unsortedConsent.setValue(attributeValuesHashFunction.apply(attribute.getValues()));
+                final List<IdPAttributeValue> sorted = new ArrayList<>(attribute.getValues());
+                Collections.sort(sorted);
+                consent.setValue(attributeValuesHashFunction.apply(sorted));
             }
 
             // Remember previous choice.
@@ -146,7 +154,9 @@ public class AttributeReleaseConsentFunction implements Function<ProfileRequestC
                 if (consentFlowDescriptor.compareValues()) {
                     if (Objects.equals(consent.getValue(), previousConsent.getValue())) {
                         consent.setApproved(previousConsent.isApproved());
-                    }
+                    } else if (Objects.equals(unsortedConsent.getValue(), previousConsent.getValue())) {
+                        consent.setApproved(previousConsent.isApproved());
+                    }  
                 } else {
                     consent.setApproved(previousConsent.isApproved());
                 }
@@ -157,5 +167,5 @@ public class AttributeReleaseConsentFunction implements Function<ProfileRequestC
 
         return currentConsents;
     }
-
+    // CheckStyle: CyclomaticComplexity ON
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.