[java-idp-oidc] branch main updated: JOIDC-165 - Introspection endpoint reads token from query-parameters

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=f80ea37d09d06442becdf69b73309254f605a42d

The following commit(s) were added to refs/heads/main by this push:
     new f80ea37d JOIDC-165 - Introspection endpoint reads token from query-parameters
f80ea37d is described below

commit f80ea37d09d06442becdf69b73309254f605a42d
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Sep 1 14:02:37 2023 +0300

    JOIDC-165 - Introspection endpoint reads token from query-parameters
    
    https://shibboleth.atlassian.net/browse/JOIDC-165
    
    Added a check that the token-parameter cannot be included in the query parameters.
---
 .../impl/OAuth2IntrospectionRequestDecoder.java    |  8 +++
 .../OAuth2IntrospectionRequestDecoderTest.java     | 74 ++++++++++++++++++++++
 2 files changed, 82 insertions(+)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2IntrospectionRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2IntrospectionRequestDecoder.java
index dd359193..5f9a6625 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2IntrospectionRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2IntrospectionRequestDecoder.java
@@ -28,6 +28,7 @@ import com.nimbusds.oauth2.sdk.http.HTTPRequest;
 import com.nimbusds.oauth2.sdk.http.JakartaServletUtils;
 
 import net.shibboleth.idp.plugin.oidc.op.decoding.impl.RequestUtil;
+import net.shibboleth.shared.primitive.StringSupport;
 
 /**
  * Message decoder decoding OpenID Connect {@link TokenIntrospectionRequest}s.
@@ -42,6 +43,13 @@ public class OAuth2IntrospectionRequestDecoder extends BaseOAuth2RequestDecoder<
     @Override
     protected TokenIntrospectionRequest parseMessage() throws MessageDecodingException {
         try {
+            final String query = StringSupport.trimOrNull(getHttpServletRequest().getQueryString());
+            // the spec mandates token to be sent in application/x-www-form-urlencoded data
+            // Nimbus allows the use of query parameters too, so we deny it by ourselves
+            if (query != null && query.contains("token=")) {
+                log.error("The query parameters contain 'token'");
+                throw new MessageDecodingException("The query parameters contain 'token'");
+            }
             final HTTPRequest httpReq = JakartaServletUtils.createHTTPRequest(getHttpServletRequest());
             getProtocolMessageLogger().trace("Inbound request {}", RequestUtil.toString(httpReq));
             return TokenIntrospectionRequest.parse(httpReq);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2IntrospectionRequestDecoderTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2IntrospectionRequestDecoderTest.java
new file mode 100644
index 00000000..4597446d
--- /dev/null
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2IntrospectionRequestDecoderTest.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.decoder.MessageDecodingException;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.testng.Assert;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.oauth2.sdk.TokenIntrospectionRequest;
+
+import jakarta.servlet.http.HttpServletRequest;
+import net.shibboleth.shared.primitive.NonnullSupplier;
+
+/**
+ * Unit tests for {@link OAuth2IntrospectionRequestDecoder}.
+ */
+public class OAuth2IntrospectionRequestDecoderTest {
+
+    private MockHttpServletRequest httpRequest;
+
+    private OAuth2IntrospectionRequestDecoder decoder;
+
+    @BeforeMethod
+    protected void setUp() throws Exception {
+        httpRequest = new MockHttpServletRequest();
+        httpRequest.setMethod("POST");
+        httpRequest.addHeader("Content-Type", "application/x-www-form-urlencoded");
+        httpRequest.addParameter("token", "45ghiukldjahdnhzdauz");
+        decoder = new OAuth2IntrospectionRequestDecoder();
+        decoder.setHttpServletRequestSupplier(new NonnullSupplier<> () {
+            public HttpServletRequest get() { return httpRequest;}
+            });
+        decoder.initialize();
+    }
+
+    @Test
+    public void testRequestDecoding() throws MessageDecodingException {
+        decoder.decode();
+        final MessageContext messageContext = decoder.getMessageContext();
+        // We are not testing nimbus itself here, i.e. we are happy to decode
+        // one parameter successfully
+        Assert.assertEquals(((TokenIntrospectionRequest) messageContext.getMessage()).getToken().toString(),
+                "45ghiukldjahdnhzdauz");
+
+    }
+
+    @Test(expectedExceptions = MessageDecodingException.class)
+    public void testInvalidRequestDecoding() throws MessageDecodingException {
+        httpRequest.removeParameter("token");
+        decoder.decode();
+    }
+
+    @Test(expectedExceptions = MessageDecodingException.class)
+    public void testTokenInQueryParams() throws MessageDecodingException {
+        httpRequest.setQueryString("one=value&token=another");
+        decoder.decode();
+    }
+
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.