[java-idp-oidc] 02/02: JOIDC-179 - Add CSP protection to views

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=81a4310166ae26f633038bf7ad1e4a0312831470

commit 81a4310166ae26f633038bf7ad1e4a0312831470
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Mar 19 16:45:08 2024 +0200

    JOIDC-179 - Add CSP protection to views
    
    https://shibboleth.atlassian.net/browse/JOIDC-179
    
    Wired the property 'idp.encoders.cspEnabled' to the encoder that
    builds the Velocity context for oidc-form-post.vm. Defaults to true.
---
 .../net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
index b16e670f..55b31ae4 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
@@ -55,8 +55,8 @@
         scope="prototype" p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier" init-method=""
         p:velocityEngine-ref="shibboleth.VelocityEngine"
         p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}"
-        p:cSPDigester-ref="OPCSPDigester"
-        p:cSPNonceGenerator-ref="OPCSPNonce"/>
+        p:cSPDigester="#{%{idp.encoders.cspEnabled:true} ? getObject('OPCSPDigester') : null}"
+        p:cSPNonceGenerator="#{%{idp.encoders.cspEnabled:true} ? getObject('OPCSPNonce') : null}"/>
 
     <bean id="EncodeMessage" class="org.opensaml.profile.action.impl.EncodeMessage" scope="prototype"
         p:messageEncoderFactory-ref="oidc.messageEncoderFactory"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.