[java-idp-plugin-oidc-rp] branch main updated: Ensure decoder input streams are closed
Phil Smart
philip.smart at jisc.ac.uk
Wed Apr 26 09:08:44 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=4b09a3e26826aefe87ac1e3bf10b71ebdfdd0918
The following commit(s) were added to refs/heads/main by this push:
new 4b09a3e Ensure decoder input streams are closed
4b09a3e is described below
commit 4b09a3e26826aefe87ac1e3bf10b71ebdfdd0918
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Apr 26 10:08:39 2023 +0100
Ensure decoder input streams are closed
---
.../impl/AbstractJSONResponseDecoderFunction.java | 2 +-
.../impl/DefaultAccessTokenResponseDecoder.java | 33 ++++++++++---------
.../impl/DefaultUserInfoResponseDecoder.java | 38 +++++++++++++---------
.../impl/AbstractRequestEncoderFunction.java | 8 ++---
.../impl/DefaultUserInfoRequestEncoder.java | 2 +-
5 files changed, 46 insertions(+), 37 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/AbstractJSONResponseDecoderFunction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/AbstractJSONResponseDecoderFunction.java
index d14c86c..2d48fe7 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/AbstractJSONResponseDecoderFunction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/AbstractJSONResponseDecoderFunction.java
@@ -59,7 +59,7 @@ public abstract class AbstractJSONResponseDecoderFunction<T> extends AbstractIni
*
* @return the object mapper.
*/
- @NonnullAfterInit public ObjectMapper getObjectMapper() {
+ @NonnullAfterInit protected ObjectMapper getObjectMapper() {
return objectMapper;
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoder.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoder.java
index 3b03252..ee692e0 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoder.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultAccessTokenResponseDecoder.java
@@ -17,6 +17,8 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.decoding.impl;
+
+import java.io.InputStream;
import java.util.Map;
import javax.annotation.Nonnull;
@@ -37,7 +39,6 @@ import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import net.minidev.json.JSONObject;
-
/**
* Default access token response decoder, which converts a successful HTTP response into an
* {@link OIDCTokenResponse}. Any decoding error is logged and {@code null} is returned.
@@ -68,24 +69,26 @@ public class DefaultAccessTokenResponseDecoder extends AbstractJSONResponseDecod
return null;
}
- final Map<String, Object> tokenResponseAsMap = getObjectMapper().readValue(
- httpResponse.getEntity().getContent(), new TypeReference<Map<String, Object>>() {});
-
- final int httpStatusCode = httpResponse.getStatusLine().getStatusCode();
-
- if (httpStatusCode != HttpStatus.SC_OK) {
- return TokenErrorResponse.parse(new JSONObject(tokenResponseAsMap));
- } else if (httpResponse.getEntity() == null || httpResponse.getEntity().getContent() == null) {
- log.warn("HTTP response does not contain a message entity, nothing to decode, status '{}'",
- httpStatusCode);
- return null;
- }
- return OIDCTokenResponse.parse(new JSONObject(tokenResponseAsMap));
+ try (InputStream input = httpResponse.getEntity().getContent()) {
+ final Map<String, Object> tokenResponseAsMap = getObjectMapper().readValue(
+ input, new TypeReference<Map<String, Object>>() {});
+
+ final int httpStatusCode = httpResponse.getStatusLine().getStatusCode();
+
+ if (httpStatusCode != HttpStatus.SC_OK) {
+ return TokenErrorResponse.parse(new JSONObject(tokenResponseAsMap));
+ } else if (httpResponse.getEntity() == null || httpResponse.getEntity().getContent() == null) {
+ log.warn("HTTP response does not contain a message entity, nothing to decode, status '{}'",
+ httpStatusCode);
+ return null;
+ }
+ return OIDCTokenResponse.parse(new JSONObject(tokenResponseAsMap));
+ }
} catch (final Exception e) {
log.warn("Unable to decode response", e);
+ return null;
}
- return null;
}
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultUserInfoResponseDecoder.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultUserInfoResponseDecoder.java
index 35f93a3..a66cdb5 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultUserInfoResponseDecoder.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultUserInfoResponseDecoder.java
@@ -17,6 +17,7 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.decoding.impl;
+import java.io.InputStream;
import java.util.Map;
import javax.annotation.Nonnull;
@@ -40,11 +41,12 @@ import com.nimbusds.openid.connect.sdk.claims.UserInfo;
/**
- * Response decoder for UserInfo responses. Supports both plain JSON Object and JWT responses. Importantly,
- * the decoder *must not ever* decode a JWT response as a plain response type, otherwise the signature check
- * may not be performed downstream - although other validation for the plain object type should. That is, we
+ * Response decoder for UserInfo responses. Supports both plain JSON Object and JWT responses.
+ *
+ * <p>Importantly,the decoder *must not ever* decode a JWT response as a plain response type, otherwise the signature
+ * check may not be performed downstream - although other validation for the plain object type should. That is, we
* can not rely solely on the content-type header in-case of content-type header injection attacks — the logic
- * that builds either the JWT or plain response should fail, or at least present an invalid UserInfo response token.
+ * that builds either the JWT or plain response should fail, or at least present an invalid UserInfo response token.</p>
*/
public class DefaultUserInfoResponseDecoder extends AbstractJSONResponseDecoderFunction<UserInfoResponse> {
@@ -61,10 +63,10 @@ public class DefaultUserInfoResponseDecoder extends AbstractJSONResponseDecoderF
if (httpResponse.getStatusLine() == null) {
log.warn("HTTP Response did not contain a status line");
return null;
- }
-
- final int httpStatusCode = httpResponse.getStatusLine().getStatusCode();
+ }
try {
+ final int httpStatusCode = httpResponse.getStatusLine().getStatusCode();
+
if (httpStatusCode != HttpStatus.SC_OK) {
if (httpResponse.getHeaders(USERINFO_ERROR_RESPONSE_HEADER) != null &&
httpResponse.getHeaders(USERINFO_ERROR_RESPONSE_HEADER).length == 1) {
@@ -104,18 +106,22 @@ public class DefaultUserInfoResponseDecoder extends AbstractJSONResponseDecoderF
// Is a JWT type or plain JSON object
if (ContentType.APPLICATION_JWT.matches(contentType)) {
- final String content = IOUtils.readInputStreamToString(httpResponse.getEntity().getContent());
- final JWT parsedJwt = JWTParser.parse(content);
- return new UserInfoSuccessResponse(parsedJwt);
+ try (InputStream input = httpResponse.getEntity().getContent()) {
+ final String content = IOUtils.readInputStreamToString(input);
+ final JWT parsedJwt = JWTParser.parse(content);
+ return new UserInfoSuccessResponse(parsedJwt);
+ }
} else if (ContentType.APPLICATION_JSON.matches(contentType)){
- final String content = IOUtils.readInputStreamToString(httpResponse.getEntity().getContent());
- final Map<String, Object> claims = getObjectMapper().readValue(
- content, new TypeReference<Map<String, Object>>() {});
- final ClaimsSet claimsSet = new ClaimsSet();
- claimsSet.putAll(claims);
- return new UserInfoSuccessResponse(new UserInfo(claimsSet.toJSONObject()));
+ try (InputStream input = httpResponse.getEntity().getContent()) {
+ final String content = IOUtils.readInputStreamToString(input);
+ final Map<String, Object> claims = getObjectMapper().readValue(
+ content, new TypeReference<Map<String, Object>>() {});
+ final ClaimsSet claimsSet = new ClaimsSet();
+ claimsSet.putAll(claims);
+ return new UserInfoSuccessResponse(new UserInfo(claimsSet.toJSONObject()));
+ }
}
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/AbstractRequestEncoderFunction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/AbstractRequestEncoderFunction.java
index 809b3e7..bad8f72 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/AbstractRequestEncoderFunction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/AbstractRequestEncoderFunction.java
@@ -114,7 +114,7 @@ public abstract class AbstractRequestEncoderFunction extends AbstractInitializab
*
* @return the authentication response.
*/
- @Nullable public AuthenticationSuccessResponse getAuthenticationResponse() {
+ @Nullable protected AuthenticationSuccessResponse getAuthenticationResponse() {
return authnResponse;
}
@@ -123,7 +123,7 @@ public abstract class AbstractRequestEncoderFunction extends AbstractInitializab
*
* @return the authentication request.
*/
- @Nullable public OIDCAuthenticationRequest getAuthenticationRequest() {
+ @Nullable protected OIDCAuthenticationRequest getAuthenticationRequest() {
return authnRequest;
}
@@ -132,7 +132,7 @@ public abstract class AbstractRequestEncoderFunction extends AbstractInitializab
*
* @return the client context.
*/
- @Nullable public OAuth2ClientAuthenticationContext getClientAuthenticationContext() {
+ @Nullable protected OAuth2ClientAuthenticationContext getClientAuthenticationContext() {
return clientAuthnContext;
}
@@ -141,7 +141,7 @@ public abstract class AbstractRequestEncoderFunction extends AbstractInitializab
*
* @return The provider metadata context.
*/
- @Nullable public OIDCProviderMetadataContext getProviderMetadataContext() {
+ @Nullable protected OIDCProviderMetadataContext getProviderMetadataContext() {
return providerMetadataContext;
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java
index f6be9e3..5b63347 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java
@@ -139,7 +139,7 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
addBearerTokenToPost(rb, responseCtx);
} else {
- log.error("Unable to construct UserInfo request, unknown request method: "+requestMethod);
+ log.error("Unable to construct UserInfo request, unknown request method: {}", requestMethod);
return null;
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list