[java-identity-provider] branch main updated: IDP-1683 Guard the protocol of the update URL nore fiercely

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=cb163d1e03befd4169afd0c2dd3470bd0a1709e0

The following commit(s) were added to refs/heads/main by this push:
       new  cb163d1e0 IDP-1683 Guard the protocol of the update URL nore fiercely
cb163d1e0 is described below

commit cb163d1e03befd4169afd0c2dd3470bd0a1709e0
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sat Nov 21 15:16:40 2020 +0000

    IDP-1683 Guard the protocol of the update URL nore fiercely
    
    https://issues.shibboleth.net/jira/browse/IDP-1683
---
 .../java/net/shibboleth/idp/installer/plugin/impl/PluginState.java   | 5 +++--
 .../shibboleth/idp/installer/plugin/impl/PluginInstallerTest.java    | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginState.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginState.java
index 0b6fdf5e4..f46b6df1f 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginState.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginState.java
@@ -278,10 +278,11 @@ public class PluginState extends AbstractInitializableComponent {
             for (final URL url: urls) {
                 final Resource propertyResource;
                 if ("file".equals(url.getProtocol())) {
-                    // Kludge to allow classpath backed files
                     propertyResource = new FileSystemResource(url.getPath());
-                } else {
+                } else if ("http".equals(url.getProtocol()) || "https".equals(url.getProtocol())) {
                     propertyResource = new HTTPResource(httpClient, url);
+                } else {
+                    throw new ComponentInitializationException("Only file and http[s] URLs are allowed");
                 }
 
                 log.debug("Plugin {}: Looking for update at {}", plugin.getPluginId(),
diff --git a/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerTest.java b/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerTest.java
index 394dfd122..12c98ab13 100644
--- a/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerTest.java
+++ b/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerTest.java
@@ -99,7 +99,7 @@ public class PluginInstallerTest extends BasePluginTest {
         }
     }
     
-    @Test(enabled = false) public void testUnpackZipFile() throws ComponentInitializationException, IOException {
+    @Test(enabled = true) public void testUnpackZipFile() throws ComponentInitializationException, IOException {
         try (final PluginInstaller inst = new PluginInstaller()) {
             inst.setIdpHome(getIdpHome());
             inst.setAcceptCert(loggingAcceptCert);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.