[java-shib-shared] branch main updated: JSSH - AttributeSupport QName conversion mishandles illegal values

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-shib-shared.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-shared.git;a=commit;h=93a3a6d3cb53c4221c3db6998673812ad2ed964e

The following commit(s) were added to refs/heads/main by this push:
     new 93a3a6d3 JSSH - AttributeSupport QName conversion mishandles illegal values
93a3a6d3 is described below

commit 93a3a6d3cb53c4221c3db6998673812ad2ed964e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu May 4 10:17:07 2023 -0400

    JSSH - AttributeSupport QName conversion mishandles illegal values
    
    https://shibboleth.atlassian.net/browse/JSSH-31
---
 .../shibboleth/shared/xml/AttributeSupport.java    | 19 ++++++++++---
 .../shared/xml/AttributeSupportTest.java           | 32 +++++++++++++++++++++-
 2 files changed, 46 insertions(+), 5 deletions(-)

diff --git a/shib-support/src/main/java/net/shibboleth/shared/xml/AttributeSupport.java b/shib-support/src/main/java/net/shibboleth/shared/xml/AttributeSupport.java
index f0837609..0127acb2 100644
--- a/shib-support/src/main/java/net/shibboleth/shared/xml/AttributeSupport.java
+++ b/shib-support/src/main/java/net/shibboleth/shared/xml/AttributeSupport.java
@@ -233,7 +233,9 @@ public final class AttributeSupport {
             qualifiedName = StringSupport.trimOrNull(trimmedLocalName);
         }
 
-        return document.createAttributeNS(StringSupport.trimOrNull(namespaceURI), qualifiedName);
+        final Attr ret = document.createAttributeNS(StringSupport.trimOrNull(namespaceURI), qualifiedName);
+        assert ret != null;
+        return ret;
     }
 
     /**
@@ -377,10 +379,19 @@ public final class AttributeSupport {
 
         final String[] valueComponents = attributeValue.split(":");
         if (valueComponents.length == 1) {
-            return QNameSupport.constructQName(attribute.lookupNamespaceURI(null), valueComponents[0], null);
+            final String localName = valueComponents[0];
+            assert localName != null;
+            return QNameSupport.constructQName(attribute.lookupNamespaceURI(null), localName, null);
         }
-        return QNameSupport.constructQName(attribute.lookupNamespaceURI(valueComponents[0]), valueComponents[1],
-                valueComponents[0]);
+        
+        if (valueComponents.length > 2) {
+            throw new IllegalStateException("Attribute value contained multiple colons");
+        }
+        
+        final String prefix = valueComponents[0];
+        final String localName = valueComponents[1];
+        assert localName != null;
+        return QNameSupport.constructQName(attribute.lookupNamespaceURI(prefix), localName, prefix);
     }
 
     /**
diff --git a/shib-support/src/test/java/net/shibboleth/shared/xml/AttributeSupportTest.java b/shib-support/src/test/java/net/shibboleth/shared/xml/AttributeSupportTest.java
index 1bbfa9b6..45069da8 100644
--- a/shib-support/src/test/java/net/shibboleth/shared/xml/AttributeSupportTest.java
+++ b/shib-support/src/test/java/net/shibboleth/shared/xml/AttributeSupportTest.java
@@ -697,8 +697,38 @@ public class AttributeSupportTest {
         s = AttributeSupport.getAttributeValue(attributes, TEST_NS, "testAttrNonExist");
         assert s == null;
     }
+    
+    @Test
+    public void testQNameContent() throws XMLParserException {
+        final DocumentBuilder builder = parserPool.getBuilder();
+        final Document doc = builder.newDocument();
+        final Attr attr = doc.createAttributeNS("https://example", "foo");
+        attr.setNodeValue("foo");
+        
+        QName qname = AttributeSupport.getAttributeValueAsQName(attr);
+        assert qname != null;
+        assertEquals(qname.getLocalPart(), "foo");
+        assertEquals(qname.getNamespaceURI(), "");
+        assertEquals(qname.getPrefix(), "");
+
+        attr.setNodeValue("bar:foo");
+        qname = AttributeSupport.getAttributeValueAsQName(attr);
+        assert qname != null;
+        assertEquals(qname.getLocalPart(), "foo");
+        assertEquals(qname.getNamespaceURI(), "");
+        assertEquals(qname.getPrefix(), "bar");
+
+        attr.setNodeValue("bar:foo:baz");
+        try {
+            qname = AttributeSupport.getAttributeValueAsQName(attr);
+            fail("Expected IllegalStateException");
+        } catch (final IllegalStateException e) {
+            // expected
+        }
+    }
 
     private <T> T nullValue() {
         return null;
     }
-}
+    
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.