[java-opensaml] branch main updated: OSJ-417 - MessageHandler to flag SAML responses with error status codes

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=6fee0c2dd8018194e223f3ce8fd64373f05f63d3

The following commit(s) were added to refs/heads/main by this push:
     new 6fee0c2dd OSJ-417 - MessageHandler to flag SAML responses with error status codes
6fee0c2dd is described below

commit 6fee0c2dd8018194e223f3ce8fd64373f05f63d3
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Oct 1 13:24:52 2024 -0400

    OSJ-417 - MessageHandler to flag SAML responses with error status codes
    
    https://shibboleth.atlassian.net/browse/OSJ-417
---
 .../binding/impl/CheckMessageStatusHandler.java    | 72 ++++++++++++++++++++++
 .../saml2/testing/SAML2ActionTestingSupport.java   | 35 +++++++++++
 2 files changed, 107 insertions(+)

diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/CheckMessageStatusHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/CheckMessageStatusHandler.java
new file mode 100644
index 000000000..de74a9982
--- /dev/null
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/CheckMessageStatusHandler.java
@@ -0,0 +1,72 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.saml.common.binding.impl;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.AbstractMessageHandler;
+import org.opensaml.messaging.handler.MessageHandlerException;
+import org.opensaml.saml.saml1.core.Response;
+import org.opensaml.saml.saml2.core.StatusResponseType;
+
+/**
+ * Message handler that raises an exception if a SAML message is a response containing an
+ * error status.
+ * 
+ * @since 5.2.0
+ */
+public class CheckMessageStatusHandler extends AbstractMessageHandler {
+
+    /** {@inheritDoc} */
+    @Override
+    protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
+        if (isErrorResponse(messageContext.getMessage())) {
+            throw new MessageHandlerException("Message was an error response.");
+        }
+    }
+
+
+    /**
+     * Get whether the message is a SAML response containing an error status.
+     * 
+     * @param message   message to check
+     * 
+     * @return  true iff the message is a SAML response containing an error status
+     */
+    private boolean isErrorResponse(@Nullable final Object message) {
+        if (message != null) {
+            if (message instanceof Response resp) {
+                final org.opensaml.saml.saml1.core.Status status = resp.getStatus();
+                if (status != null) {
+                    final org.opensaml.saml.saml1.core.StatusCode s1 = status.getStatusCode();
+                    return s1 != null && s1.getValue() != null
+                            && !org.opensaml.saml.saml1.core.StatusCode.SUCCESS.equals(s1.getValue());
+                }
+            } else if (message instanceof StatusResponseType resp) {
+                final org.opensaml.saml.saml2.core.Status status = resp.getStatus();
+                if (status != null) {
+                    final org.opensaml.saml.saml2.core.StatusCode s2 = status.getStatusCode();
+                    return s2 != null && s2.getValue() != null
+                            && !org.opensaml.saml.saml2.core.StatusCode.SUCCESS.equals(s2.getValue());
+                }
+            }
+        }
+        
+        return false;
+    }
+
+}
\ No newline at end of file
diff --git a/opensaml-testing/src/main/java/org/opensaml/saml/saml2/testing/SAML2ActionTestingSupport.java b/opensaml-testing/src/main/java/org/opensaml/saml/saml2/testing/SAML2ActionTestingSupport.java
index 4847072fb..3b8041e09 100644
--- a/opensaml-testing/src/main/java/org/opensaml/saml/saml2/testing/SAML2ActionTestingSupport.java
+++ b/opensaml-testing/src/main/java/org/opensaml/saml/saml2/testing/SAML2ActionTestingSupport.java
@@ -43,6 +43,8 @@ import org.opensaml.saml.saml2.core.LogoutResponse;
 import org.opensaml.saml.saml2.core.NameID;
 import org.opensaml.saml.saml2.core.Response;
 import org.opensaml.saml.saml2.core.Scoping;
+import org.opensaml.saml.saml2.core.Status;
+import org.opensaml.saml.saml2.core.StatusCode;
 import org.opensaml.saml.saml2.core.Subject;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
@@ -408,4 +410,37 @@ public class SAML2ActionTestingSupport {
         return request;
     }
     
+    /**
+     * Builds a {@link Status}.
+     * 
+     * @param codeString status code string
+     * @param subcodeString subcode string if any
+     * 
+     * @return the object
+     * 
+     * @aince 5.2.0
+     */
+    @Nonnull public static Status buildStatus(@Nonnull final String codeString, @Nullable final String subcodeString) {
+        final SAMLObjectBuilder<StatusCode> codeBuilder = (SAMLObjectBuilder<StatusCode>)
+                XMLObjectProviderRegistrySupport.getBuilderFactory().<StatusCode>ensureBuilder(
+                        Status.DEFAULT_ELEMENT_NAME);
+        final SAMLObjectBuilder<Status> statusBuilder = (SAMLObjectBuilder<Status>)
+                XMLObjectProviderRegistrySupport.getBuilderFactory().<Status>ensureBuilder(
+                        Status.DEFAULT_ELEMENT_NAME);
+
+        final StatusCode code = codeBuilder.buildObject();
+        code.setValue(codeString);
+        
+        if (subcodeString != null) {
+            final StatusCode subcode = codeBuilder.buildObject();
+            subcode.setValue(subcodeString);
+            code.setStatusCode(subcode);
+        }
+        
+        final Status status = statusBuilder.buildObject();
+        status.setStatusCode(code);
+        
+        return status;
+    }
+    
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.