[java-support] branch maint-8 updated: JSPT-124 - AttributeSupport QName conversion mishandles illegal values

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch maint-8
in repository java-support.

View the commit online:
http://git.shibboleth.net/view/?p=java-support.git;a=commit;h=c74d65db777b7738be7e5314920679e3d415e4e5

The following commit(s) were added to refs/heads/maint-8 by this push:
     new c74d65d  JSPT-124 - AttributeSupport QName conversion mishandles illegal values
c74d65d is described below

commit c74d65db777b7738be7e5314920679e3d415e4e5
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Mar 14 11:51:40 2024 -0400

    JSPT-124 - AttributeSupport QName conversion mishandles illegal values
    
    https://shibboleth.atlassian.net/browse/JSPT-124
    
    Backport from java-shib-shared.
---
 .../java/support/xml/AttributeSupport.java         |  5 ++++
 .../java/support/xml/AttributeSupportTest.java     | 27 ++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/src/main/java/net/shibboleth/utilities/java/support/xml/AttributeSupport.java b/src/main/java/net/shibboleth/utilities/java/support/xml/AttributeSupport.java
index 20d2578..4a92d7a 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/xml/AttributeSupport.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/xml/AttributeSupport.java
@@ -346,6 +346,11 @@ public final class AttributeSupport {
         if (valueComponents.length == 1) {
             return QNameSupport.constructQName(attribute.lookupNamespaceURI(null), valueComponents[0], null);
         }
+        
+        if (valueComponents.length > 2) {
+            throw new IllegalStateException("Attribute value contained multiple colons");
+        }
+                    
         return QNameSupport.constructQName(attribute.lookupNamespaceURI(valueComponents[0]), valueComponents[1],
                 valueComponents[0]);
     }
diff --git a/src/test/java/net/shibboleth/utilities/java/support/xml/AttributeSupportTest.java b/src/test/java/net/shibboleth/utilities/java/support/xml/AttributeSupportTest.java
index d72d0f3..e9383bf 100644
--- a/src/test/java/net/shibboleth/utilities/java/support/xml/AttributeSupportTest.java
+++ b/src/test/java/net/shibboleth/utilities/java/support/xml/AttributeSupportTest.java
@@ -648,6 +648,33 @@ public class AttributeSupportTest {
 
     }
 
+    @Test
+    public void testQNameContent() throws XMLParserException {
+        final DocumentBuilder builder = parserPool.getBuilder();
+        final Document doc = builder.newDocument();
+        final Attr attr = doc.createAttributeNS("https://example", "foo");
+        attr.setNodeValue("foo");
+        
+        QName qname = AttributeSupport.getAttributeValueAsQName(attr);
+        Assert.assertEquals(qname.getLocalPart(), "foo");
+        Assert.assertEquals(qname.getNamespaceURI(), "");
+        Assert.assertEquals(qname.getPrefix(), "");
+
+        attr.setNodeValue("bar:foo");
+        qname = AttributeSupport.getAttributeValueAsQName(attr);
+        Assert.assertEquals(qname.getLocalPart(), "foo");
+        Assert.assertEquals(qname.getNamespaceURI(), "");
+        Assert.assertEquals(qname.getPrefix(), "bar");
+
+        attr.setNodeValue("bar:foo:baz");
+        try {
+            qname = AttributeSupport.getAttributeValueAsQName(attr);
+            Assert.fail("Expected IllegalStateException");
+        } catch (final IllegalStateException e) {
+            // expected
+        }
+    }
+    
     private <T> T nullValue() {
         return null;
     }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.