[java-opensaml] branch main updated: IDP-1694 - IPv6 fails when servlet container uses square brackets
Scott Cantor
cantor.2 at osu.edu
Tue Oct 20 14:08:24 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=689644a26cde82aa6727dafed96636fbe2f2df32
The following commit(s) were added to refs/heads/main by this push:
new 689644a26 IDP-1694 - IPv6 fails when servlet container uses square brackets
689644a26 is described below
commit 689644a26cde82aa6727dafed96636fbe2f2df32
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Oct 20 10:08:20 2020 -0400
IDP-1694 - IPv6 fails when servlet container uses square brackets
https://issues.shibboleth.net/jira/browse/IDP-1694
Apply sanitizing helper method.
---
.../src/main/java/org/opensaml/profile/logic/IPRangePredicate.java | 3 ++-
.../test/java/org/opensaml/profile/logic/IPRangePredicateTest.java | 3 +--
.../saml/saml2/profile/impl/AddSubjectConfirmationToSubjects.java | 4 +++-
.../saml2/profile/impl/DefaultAssertionValidationContextBuilder.java | 3 ++-
.../impl/DefaultSAML20AssertionValidationContextBuilder.java | 3 ++-
5 files changed, 10 insertions(+), 6 deletions(-)
diff --git a/opensaml-profile-api/src/main/java/org/opensaml/profile/logic/IPRangePredicate.java b/opensaml-profile-api/src/main/java/org/opensaml/profile/logic/IPRangePredicate.java
index bfbaf6c62..8490dad99 100644
--- a/opensaml-profile-api/src/main/java/org/opensaml/profile/logic/IPRangePredicate.java
+++ b/opensaml-profile-api/src/main/java/org/opensaml/profile/logic/IPRangePredicate.java
@@ -32,6 +32,7 @@ import com.google.common.net.InetAddresses;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.Predicate;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.net.IPRange;
/**
@@ -74,7 +75,7 @@ public class IPRangePredicate implements Predicate<BaseContext> {
/** {@inheritDoc} */
public boolean test(@Nullable final BaseContext input) {
- final String address = httpRequest != null ? httpRequest.getRemoteAddr() : null;
+ final String address = httpRequest != null ? HttpServletSupport.getRemoteAddr(httpRequest) : null;
if (address == null || !InetAddresses.isInetAddress(address)) {
return false;
}
diff --git a/opensaml-profile-api/src/test/java/org/opensaml/profile/logic/IPRangePredicateTest.java b/opensaml-profile-api/src/test/java/org/opensaml/profile/logic/IPRangePredicateTest.java
index df0da9cbb..184658f18 100644
--- a/opensaml-profile-api/src/test/java/org/opensaml/profile/logic/IPRangePredicateTest.java
+++ b/opensaml-profile-api/src/test/java/org/opensaml/profile/logic/IPRangePredicateTest.java
@@ -67,9 +67,8 @@ public class IPRangePredicateTest {
request.setRemoteAddr("2620:df:8000:ff14:0:0:0:3");
Assert.assertFalse(condition.test(null));
- // TODO reverse once we handle brackets.
request.setRemoteAddr("[2620:df:8000:ff14:0:0:0:2]");
- Assert.assertFalse(condition.test(null));
+ Assert.assertTrue(condition.test(null));
}
}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddSubjectConfirmationToSubjects.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddSubjectConfirmationToSubjects.java
index c7eab215d..3a8c72195 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddSubjectConfirmationToSubjects.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddSubjectConfirmationToSubjects.java
@@ -35,6 +35,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
@@ -120,7 +121,8 @@ public class AddSubjectConfirmationToSubjects extends AbstractProfileAction {
// Default pulls from servlet request.
addressLookupStrategy = new Function<>() {
public String apply(final ProfileRequestContext input) {
- final String address = getHttpServletRequest() != null ? getHttpServletRequest().getRemoteAddr() : null;
+ final String address = getHttpServletRequest() != null ?
+ HttpServletSupport.getRemoteAddr(getHttpServletRequest()) : null;
log.debug("{} Setting confirmation data Address to {}", getLogPrefix(),
address != null ? address : "(none)");
return address;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
index ebb15faff..291bed3ef 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
@@ -73,6 +73,7 @@ import com.google.common.base.Predicates;
import net.shibboleth.utilities.java.support.collection.LazySet;
import net.shibboleth.utilities.java.support.collection.Pair;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -925,7 +926,7 @@ public class DefaultAssertionValidationContextBuilder
*/
@Nonnull protected String getAttesterIPAddress(@Nonnull final AssertionValidationInput input) {
//TODO support indirection via SAMLBindingSupport and use of SAMLMessageReceivedEndpointContext?
- return input.getHttpServletRequest().getRemoteAddr();
+ return HttpServletSupport.getRemoteAddr(input.getHttpServletRequest());
}
/**
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java
index e7eed2c76..b1e080d53 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java
@@ -33,6 +33,7 @@ import javax.annotation.Nullable;
import net.shibboleth.utilities.java.support.collection.LazySet;
import net.shibboleth.utilities.java.support.collection.Pair;
+import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -340,7 +341,7 @@ public class DefaultSAML20AssertionValidationContextBuilder
* @return the IP address of the attester
*/
@Nonnull protected String getAttesterIPAddress(@Nonnull final SAML20AssertionTokenValidationInput input) {
- return input.getHttpServletRequest().getRemoteAddr();
+ return HttpServletSupport.getRemoteAddr(input.getHttpServletRequest());
}
/**
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list