[java-idp-plugin-duo] branch main updated: JDUO-74 - Possible leaks in HTTP response handling
Scott Cantor
cantor.2 at osu.edu
Fri Sep 1 13:51:00 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=5d19342cbc6265a467a1018b9d296f779cf8611e
The following commit(s) were added to refs/heads/main by this push:
new 5d19342 JDUO-74 - Possible leaks in HTTP response handling
5d19342 is described below
commit 5d19342cbc6265a467a1018b9d296f779cf8611e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Sep 1 09:50:57 2023 -0400
JDUO-74 - Possible leaks in HTTP response handling
https://shibboleth.atlassian.net/browse/JDUO-74
Also wrap HttpEntity access with try-with-resources
Fix duplicate call to HttpEntity.getContent
---
.../authn/duo/impl/AbstractDuoAuthenticator.java | 56 +++++++++++-----------
.../plugin/authn/duo/nimbus/impl/NimbusClient.java | 38 ++++++++-------
2 files changed, 49 insertions(+), 45 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoAuthenticator.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoAuthenticator.java
index 85c8670..941ff39 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoAuthenticator.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoAuthenticator.java
@@ -129,19 +129,20 @@ public abstract class AbstractDuoAuthenticator extends AbstractInitializableComp
// Check the HTTP response code.
final int httpStatusCode = httpResponse.getCode();
if (httpStatusCode == HttpStatus.SC_BAD_REQUEST) {
- final HttpEntity entity = httpResponse.getEntity();
- if (entity == null) {
- throw new IOException("Bad request status code (" + httpStatusCode + ") returned from Duo: "
- + (httpResponse.getReasonPhrase() != null ? httpResponse.getReasonPhrase() : "none"));
- }
- try (final InputStream httpContent = entity.getContent()) {
- final DuoFailureResponse msg = objectMapper.readValue(httpContent, DuoFailureResponse.class);
- final StringBuilder builder = new StringBuilder();
- builder.append(msg.getMessage() != null ? msg.getMessage() : "no message")
- .append(" (")
- .append(msg.getMessageDetail() != null ? msg.getMessageDetail() : "no detail")
- .append(")");
- throw new DuoException(builder.toString());
+ try (final HttpEntity entity = httpResponse.getEntity()) {
+ if (entity == null) {
+ throw new IOException("Bad request status code (" + httpStatusCode + ") returned from Duo: "
+ + (httpResponse.getReasonPhrase() != null ? httpResponse.getReasonPhrase() : "none"));
+ }
+ try (final InputStream httpContent = entity.getContent()) {
+ final DuoFailureResponse msg = objectMapper.readValue(httpContent, DuoFailureResponse.class);
+ final StringBuilder builder = new StringBuilder();
+ builder.append(msg.getMessage() != null ? msg.getMessage() : "no message")
+ .append(" (")
+ .append(msg.getMessageDetail() != null ? msg.getMessageDetail() : "no detail")
+ .append(")");
+ throw new DuoException(builder.toString());
+ }
}
}
if (httpStatusCode != HttpStatus.SC_OK) {
@@ -149,22 +150,23 @@ public abstract class AbstractDuoAuthenticator extends AbstractInitializableComp
+ (httpResponse.getReasonPhrase() != null ? httpResponse.getReasonPhrase() : "none"));
}
- final HttpEntity entity = httpResponse.getEntity();
- if (entity == null) {
- throw new IOException("No response body returned from Duo");
- }
-
- // Parse the JSON response.
- try (final InputStream content = entity.getContent()) {
- final T duoResponse = objectMapper.readValue(entity.getContent(), wrapperTypeRef);
+ try (final HttpEntity entity = httpResponse.getEntity()) {
+ if (entity == null) {
+ throw new IOException("No response body returned from Duo");
+ }
+
+ // Parse the JSON response.
+ try (final InputStream content = entity.getContent()) {
+ final T duoResponse = objectMapper.readValue(content, wrapperTypeRef);
+
+ if (duoResponse == null) {
+ throw new DuoException("Unable to parse JSON response");
+ } else if (!"OK".equals(duoResponse.getStat())) {
+ throw new DuoException("Unexpected status value in JSON response: " + duoResponse.getStat());
+ }
- if (duoResponse == null) {
- throw new DuoException("Unable to parse JSON response");
- } else if (!"OK".equals(duoResponse.getStat())) {
- throw new DuoException("Unexpected status value in JSON response: " + duoResponse.getStat());
+ return duoResponse;
}
-
- return duoResponse;
}
}
}
diff --git a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
index d814f88..8bd2e50 100644
--- a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
+++ b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
@@ -211,7 +211,7 @@ public final class NimbusClient extends AbstractDuoOIDCClient{
*
* @throws DuoClientException if there is an error producing a response
*/
- private <T> T executeRequest(@Nonnull final ClassicHttpRequest request,
+ @Nonnull private <T> T executeRequest(@Nonnull final ClassicHttpRequest request,
@Nonnull final TypeReference<T> wrapperTypeRef) throws DuoClientException{
try {
@@ -226,29 +226,31 @@ public final class NimbusClient extends AbstractDuoOIDCClient{
final int httpStatusCode = httpResponse.getCode();
if (httpStatusCode != HttpStatus.SC_OK) {
//dump the body for logging - if one exists
- final HttpEntity entity = httpResponse.getEntity();
- if (entity != null) {
- try (final InputStream content = entity.getContent()) {
- final String errorContent = IOUtils.readInputStreamToString(content);
- log.error("Duo returned a Non-ok message of '{}'", errorContent);
+ try (final HttpEntity entity = httpResponse.getEntity()) {
+ if (entity != null) {
+ try (final InputStream content = entity.getContent()) {
+ final String errorContent = IOUtils.readInputStreamToString(content);
+ log.error("Duo returned a Non-ok message of '{}'", errorContent);
+ }
}
}
throw new DuoClientException("Non-ok status code (" + httpStatusCode + ") returned from Duo: "
+ (httpResponse.getReasonPhrase() != null ? httpResponse.getReasonPhrase() : "none"));
}
- final HttpEntity entity = httpResponse.getEntity();
- if (entity == null) {
- throw new DuoClientException("No response body returned from Duo");
- }
-
- // Parse the JSON response.
- try (final InputStream content = entity.getContent()) {
- final T duoResponse = objectMapper.readValue(content, wrapperTypeRef);
- if (duoResponse == null) {
- throw new DuoClientException("Unable to parse JSON response");
- }
- return duoResponse;
+ try (final HttpEntity entity = httpResponse.getEntity()) {
+ if (entity == null) {
+ throw new DuoClientException("No response body returned from Duo");
+ }
+
+ // Parse the JSON response.
+ try (final InputStream content = entity.getContent()) {
+ final T duoResponse = objectMapper.readValue(content, wrapperTypeRef);
+ if (duoResponse == null) {
+ throw new DuoClientException("Unable to parse JSON response");
+ }
+ return duoResponse;
+ }
}
}
} catch (final IOException | URISyntaxException e) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list