[java-identity-provider] branch dev/IDP-2183 updated: IDP-2183 - Use of JS in views needs to be hardened via CSP

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch dev/IDP-2183
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=cce637eec1d48f589f1b350e6abeeed84a673eaa

The following commit(s) were added to refs/heads/dev/IDP-2183 by this push:
     new cce637eec IDP-2183 - Use of JS in views needs to be hardened via CSP
cce637eec is described below

commit cce637eec1d48f589f1b350e6abeeed84a673eaa
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Oct 31 17:11:31 2023 -0400

    IDP-2183 - Use of JS in views needs to be hardened via CSP
    
    https://shibboleth.atlassian.net/browse/IDP-2183
    
    Add property for controlling OpenSAML CSP support.
    Inject digester/etc. conditionally into message encoders.
---
 .../net/shibboleth/idp/conf/saml-binding-config.xml          | 12 +++++++++---
 .../resources/net/shibboleth/idp/module/conf/idp.properties  |  2 ++
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
index 2c5305dbc..7ffd15342 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
@@ -134,7 +134,9 @@
     <bean id="shibboleth.Encoders.SAML1PostEncoder"
           class="org.opensaml.saml.saml1.binding.encoding.impl.HTTPPostEncoder" scope="prototype" init-method=""
           p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier"
-          p:velocityEngine-ref="shibboleth.VelocityEngine" />
+          p:velocityEngine-ref="shibboleth.VelocityEngine"
+          p:cSPDigester="#{%{idp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPDigester') : null}"
+          p:cSPNonceGenerator="#{%{idp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPNonce') : null}" />
 
     <bean id="shibboleth.Encoders.SAML1ArtifactEncoder"
           class="org.opensaml.saml.saml1.binding.encoding.impl.HTTPArtifactEncoder" scope="prototype" init-method=""
@@ -152,12 +154,16 @@
     <bean id="shibboleth.Encoders.SAML2PostEncoder"
           class="org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder" scope="prototype" init-method=""
           p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier"
-          p:velocityEngine-ref="shibboleth.VelocityEngine" />
+          p:velocityEngine-ref="shibboleth.VelocityEngine"
+          p:cSPDigester="#{%{idp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPDigester') : null}"
+          p:cSPNonceGenerator="#{%{idp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPNonce') : null}" />
 
     <bean id="shibboleth.Encoders.SAML2PostSimpleSignEncoder"
           class="org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostSimpleSignEncoder" scope="prototype" init-method=""
           p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier"
-          p:velocityEngine-ref="shibboleth.VelocityEngine" />
+          p:velocityEngine-ref="shibboleth.VelocityEngine"
+          p:cSPDigester="#{%{idp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPDigester') : null}"
+          p:cSPNonceGenerator="#{%{idp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPNonce') : null}" />
 
     <bean id="shibboleth.Encoders.SAML2ArtifactEncoder"
           class="org.opensaml.saml.saml2.binding.encoding.impl.HTTPArtifactEncoder" scope="prototype" init-method=""
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
index ca5cb4ec3..a01684ae5 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
@@ -47,6 +47,8 @@ idp.csrf.enabled = true
 #idp.frameoptions = DENY
 # Content-Security-Policy value, set to match X-Frame-Options default
 #idp.csp = frame-ancestors 'none'; base-uri 'none';
+# Set to false to disable CSP protection within SAML message templates
+#idp.encoders.cspEnabled = true
 
 # Set to false to disable filter that forcibly applies UTF-8 encoding
 #idp.encoding.forceUTF8 = true

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.