[java-identity-provider] branch main updated: IDP-1968 - Basic auth restricting Authorization header to US-ASCII

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=c34126a4694ae04da18fde276c768b72c82ff0e4

The following commit(s) were added to refs/heads/main by this push:
     new c34126a46 IDP-1968 - Basic auth restricting Authorization header to US-ASCII
c34126a46 is described below

commit c34126a4694ae04da18fde276c768b72c82ff0e4
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jun 29 09:39:21 2022 -0400

    IDP-1968 - Basic auth restricting Authorization header to US-ASCII
    
    https://shibboleth.atlassian.net/browse/IDP-1968
---
 .../authn/impl/ExtractUsernamePasswordFromBasicAuth.java    |  2 +-
 .../impl/ExtractUsernamePasswordFromBasicAuthTest.java      | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuth.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuth.java
index 197479d3c..bf235e7d7 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuth.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuth.java
@@ -128,7 +128,7 @@ public class ExtractUsernamePasswordFromBasicAuth extends AbstractExtractionActi
     @Nullable protected Pair<String,String> decodeCredentials(@Nonnull @NotEmpty final String encodedCredentials) {
         String decodedUserPass = null;
         try {
-            decodedUserPass = new String(Base64Support.decode(encodedCredentials), Charsets.US_ASCII);
+            decodedUserPass = new String(Base64Support.decode(encodedCredentials), Charsets.UTF_8);
         } catch (final DecodingException e) {
             log.warn("{} Credentials could not be base64 decoded: {}",getLogPrefix(),e.getMessage());
             //nothing else, decodedUserPass remains null.
diff --git a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuthTest.java b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuthTest.java
index 18533da83..7572ac17c 100644
--- a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuthTest.java
+++ b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuthTest.java
@@ -90,7 +90,6 @@ public class ExtractUsernamePasswordFromBasicAuthTest extends BaseAuthentication
     
     @Test public void testValid() {
         ((MockHttpServletRequest) action.getHttpServletRequest()).addHeader(HttpHeaders.AUTHORIZATION, "Basic Zm9vOmJhcg==");
-        
         final Event event = action.execute(src);
         ActionTestingSupport.assertProceedEvent(event);
         AuthenticationContext authCtx = prc.getSubcontext(AuthenticationContext.class, false);
@@ -99,4 +98,16 @@ public class ExtractUsernamePasswordFromBasicAuthTest extends BaseAuthentication
         Assert.assertEquals(upCtx.getUsername(), "foo");
         Assert.assertEquals(upCtx.getPassword(), "bar");
     }
+
+    @Test public void idp1968() {
+        ((MockHttpServletRequest) action.getHttpServletRequest()).addHeader(HttpHeaders.AUTHORIZATION, "Basic Zm9vOuKYr++4j2Jhcg==");
+        
+        final Event event = action.execute(src);
+        ActionTestingSupport.assertProceedEvent(event);
+        AuthenticationContext authCtx = prc.getSubcontext(AuthenticationContext.class, false);
+        UsernamePasswordContext upCtx = authCtx.getSubcontext(UsernamePasswordContext.class, false);
+        Assert.assertNotNull(upCtx, "No UsernamePasswordContext attached");
+        Assert.assertEquals(upCtx.getUsername(), "foo");
+        Assert.assertEquals(upCtx.getPassword(), "☯️bar");
+    }
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.