[java-idp-plugin-duo] branch main updated: JDUO-74 - Possible leaks in HTTP response handling
Phil Smart
philip.smart at jisc.ac.uk
Mon Aug 28 21:57:49 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=076d2730effc9abf7c85eed65d731ddff5056434
The following commit(s) were added to refs/heads/main by this push:
new 076d273 JDUO-74 - Possible leaks in HTTP response handling
076d273 is described below
commit 076d2730effc9abf7c85eed65d731ddff5056434
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Aug 28 22:57:13 2023 +0100
JDUO-74 - Possible leaks in HTTP response handling
- Add try-with-resources to ClassicalHttpResponse objects.
https://shibboleth.atlassian.net/browse/JDUO-74
---
.../authn/duo/impl/AbstractDuoAuthenticator.java | 65 +++++++++++-----------
.../plugin/authn/duo/nimbus/impl/NimbusClient.java | 47 ++++++++--------
2 files changed, 57 insertions(+), 55 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoAuthenticator.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoAuthenticator.java
index d82d941..630004c 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoAuthenticator.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoAuthenticator.java
@@ -119,40 +119,41 @@ public abstract class AbstractDuoAuthenticator extends AbstractInitializableComp
assert clientContext != null;
HttpClientSecuritySupport.marshalSecurityParameters(clientContext, httpClientSecurityParameters, true);
HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(clientContext, request);
- final ClassicHttpResponse httpResponse = httpClient.executeOpen(null, request, clientContext);
- final String scheme = request.getScheme();
- assert scheme != null;
- HttpClientSecuritySupport.checkTLSCredentialEvaluated(clientContext, scheme);
-
- // Check the HTTP response code.
- final int httpStatusCode = httpResponse.getCode();
- if (httpStatusCode == HttpStatus.SC_BAD_REQUEST) {
- final InputStream httpContent = httpResponse.getEntity().getContent();
- final DuoFailureResponse msg = objectMapper.readValue(httpContent, DuoFailureResponse.class);
- final StringBuilder builder = new StringBuilder();
- builder.append(msg.getMessage() != null ? msg.getMessage() : "no message")
- .append(" (")
- .append(msg.getMessageDetail() != null ? msg.getMessageDetail() : "no detail")
- .append(")");
- throw new DuoException(builder.toString());
- }
- if (httpStatusCode != HttpStatus.SC_OK) {
- throw new IOException("Non-ok status code (" + httpStatusCode + ") returned from Duo: "
- + httpResponse.getReasonPhrase());
- } else if (httpResponse.getEntity() == null) {
- throw new IOException("No response body returned from Duo");
- }
-
- // Parse the JSON response.
- final T duoResponse = objectMapper.readValue(httpResponse.getEntity().getContent(), wrapperTypeRef);
+ try (final ClassicHttpResponse httpResponse = httpClient.executeOpen(null, request, clientContext)){
+ final String scheme = request.getScheme();
+ assert scheme != null;
+ HttpClientSecuritySupport.checkTLSCredentialEvaluated(clientContext, scheme);
+
+ // Check the HTTP response code.
+ final int httpStatusCode = httpResponse.getCode();
+ if (httpStatusCode == HttpStatus.SC_BAD_REQUEST) {
+ final InputStream httpContent = httpResponse.getEntity().getContent();
+ final DuoFailureResponse msg = objectMapper.readValue(httpContent, DuoFailureResponse.class);
+ final StringBuilder builder = new StringBuilder();
+ builder.append(msg.getMessage() != null ? msg.getMessage() : "no message")
+ .append(" (")
+ .append(msg.getMessageDetail() != null ? msg.getMessageDetail() : "no detail")
+ .append(")");
+ throw new DuoException(builder.toString());
+ }
+ if (httpStatusCode != HttpStatus.SC_OK) {
+ throw new IOException("Non-ok status code (" + httpStatusCode + ") returned from Duo: "
+ + httpResponse.getReasonPhrase());
+ } else if (httpResponse.getEntity() == null) {
+ throw new IOException("No response body returned from Duo");
+ }
+
+ // Parse the JSON response.
+ final T duoResponse = objectMapper.readValue(httpResponse.getEntity().getContent(), wrapperTypeRef);
+
+ if (duoResponse == null) {
+ throw new DuoException("Unable to parse JSON response");
+ } else if (!"OK".equals(duoResponse.getStat())) {
+ throw new DuoException("Unexpected status value in JSON response: " + duoResponse.getStat());
+ }
- if (duoResponse == null) {
- throw new DuoException("Unable to parse JSON response");
- } else if (!"OK".equals(duoResponse.getStat())) {
- throw new DuoException("Unexpected status value in JSON response: " + duoResponse.getStat());
+ return duoResponse;
}
-
- return duoResponse;
}
}
diff --git a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
index 2ee686f..5c26ec3 100644
--- a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
+++ b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
@@ -217,30 +217,31 @@ public final class NimbusClient extends AbstractDuoOIDCClient{
assert clientContext != null;
HttpClientSecuritySupport.marshalSecurityParameters(clientContext, httpClientSecurityParameters, true);
HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(clientContext, request);
- final ClassicHttpResponse httpResponse = httpClient.executeOpen(null, request, clientContext);
- assert httpResponse != null;
- HttpClientSecuritySupport.checkTLSCredentialEvaluated(clientContext, request.getUri().getScheme());
-
- final int httpStatusCode = httpResponse.getCode();
- if (httpStatusCode != HttpStatus.SC_OK) {
- //dump the body for logging - if one exists
- if (httpResponse.getEntity() != null && httpResponse.getEntity().getContent() != null) {
- final String errorContent = IOUtils.readInputStreamToString(httpResponse.getEntity().getContent());
- log.error("Duo returned a Non-ok message of '{}'",errorContent);
+ try (final ClassicHttpResponse httpResponse = httpClient.executeOpen(null, request, clientContext)){
+ assert httpResponse != null;
+ HttpClientSecuritySupport.checkTLSCredentialEvaluated(clientContext, request.getUri().getScheme());
+
+ final int httpStatusCode = httpResponse.getCode();
+ if (httpStatusCode != HttpStatus.SC_OK) {
+ //dump the body for logging - if one exists
+ if (httpResponse.getEntity() != null && httpResponse.getEntity().getContent() != null) {
+ final String errorContent =
+ IOUtils.readInputStreamToString(httpResponse.getEntity().getContent());
+ log.error("Duo returned a Non-ok message of '{}'",errorContent);
+ }
+ throw new DuoClientException("Non-ok status code (" + httpStatusCode + ") returned from Duo: "
+ + httpResponse.getReasonPhrase());
+ } else if (httpResponse.getEntity() == null) {
+ throw new DuoClientException("No response body returned from Duo");
}
- throw new DuoClientException("Non-ok status code (" + httpStatusCode + ") returned from Duo: "
- + httpResponse.getReasonPhrase());
- } else if (httpResponse.getEntity() == null) {
- throw new DuoClientException("No response body returned from Duo");
- }
-
- // Parse the JSON response.
- final T duoResponse = objectMapper.readValue(httpResponse.getEntity().getContent(),wrapperTypeRef);
- if (duoResponse == null) {
- throw new DuoClientException("Unable to parse JSON response");
- }
- return duoResponse;
-
+
+ // Parse the JSON response.
+ final T duoResponse = objectMapper.readValue(httpResponse.getEntity().getContent(),wrapperTypeRef);
+ if (duoResponse == null) {
+ throw new DuoClientException("Unable to parse JSON response");
+ }
+ return duoResponse;
+ }
} catch (final IOException | URISyntaxException e) {
throw new DuoClientException("Could not execute Duo HTTP request",e);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list