[java-opensaml] branch main updated: IDP-2163 - Warning interceptor could exploit StorageService

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=4e93cefd2f708d4d514f0d8851fc3891fc3dc536

The following commit(s) were added to refs/heads/main by this push:
     new 4e93cefd2 IDP-2163 - Warning interceptor could exploit StorageService
4e93cefd2 is described below

commit 4e93cefd2f708d4d514f0d8851fc3891fc3dc536
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Dec 13 15:56:18 2023 -0500

    IDP-2163 - Warning interceptor could exploit StorageService
    
    https://shibboleth.atlassian.net/browse/IDP-2163
    
    Fix getter behavior when backfilling and adjust test.
---
 .../org/opensaml/storage/StorageAwareCookieManager.java  | 16 ++++++++++------
 .../storage/impl/StorageAwareCookieManagerTest.java      |  2 +-
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/opensaml-storage-api/src/main/java/org/opensaml/storage/StorageAwareCookieManager.java b/opensaml-storage-api/src/main/java/org/opensaml/storage/StorageAwareCookieManager.java
index 860a15bf4..574b226e2 100644
--- a/opensaml-storage-api/src/main/java/org/opensaml/storage/StorageAwareCookieManager.java
+++ b/opensaml-storage-api/src/main/java/org/opensaml/storage/StorageAwareCookieManager.java
@@ -131,14 +131,16 @@ public class StorageAwareCookieManager extends CookieManager {
     /** {@inheritDoc} */
     @Override
     @Nullable public String getCookieValue(@Nonnull final String name, @Nullable final String defValue) {
-        final String val = super.getCookieValue(name, defValue);
-        if (val != null) {
-            return val;
-        }
         
-        if (storageService != null) {
+        final StorageService ss = storageService;
+        if (ss != null) {
             try {
-                final StorageRecord<String> record = storageService.read(storageContext, name);
+                final String val = super.getCookieValue(name, null);
+                if (val != null) {
+                    return val;
+                }
+
+                final StorageRecord<String> record = ss.read(storageContext, name);
                 if (record != null) {
                     log.debug("Backfilling/setting missing cookie {} based on stored record", name);
                     final Long exp = record.getExpiration();
@@ -154,6 +156,8 @@ public class StorageAwareCookieManager extends CookieManager {
             } catch (final IOException e) {
                 log.warn("Error reading cookie record from storage service", e);
             }
+        } else {
+            return super.getCookieValue(name, defValue);
         }
         
         return defValue;
diff --git a/opensaml-storage-impl/src/test/java/org/opensaml/storage/impl/StorageAwareCookieManagerTest.java b/opensaml-storage-impl/src/test/java/org/opensaml/storage/impl/StorageAwareCookieManagerTest.java
index c546ff0c8..acc1e172a 100644
--- a/opensaml-storage-impl/src/test/java/org/opensaml/storage/impl/StorageAwareCookieManagerTest.java
+++ b/opensaml-storage-impl/src/test/java/org/opensaml/storage/impl/StorageAwareCookieManagerTest.java
@@ -133,7 +133,7 @@ public class StorageAwareCookieManagerTest {
         
         storage.create(cm.getStorageContext(), "foo", "bar", Instant.now().plusSeconds(600).toEpochMilli());
         
-        Assert.assertEquals(cm.getCookieValue("foo", null), "bar");
+        Assert.assertEquals(cm.getCookieValue("foo", "baz"), "bar");
         
         final Cookie cookie = response.getCookie("foo");
         assert(cookie != null);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.