[java-idp-plugin-vci] 01/05: Add check for code verifier length. Wrap Nimbus TokenRequest if it can be parsed
Codeberg
noreply at shibboleth.net
Wed Dec 3 12:02:53 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch DPOP
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/5c4a2b607a61893c2033d48288bbd8e2306b92dd
commit 5c4a2b607a61893c2033d48288bbd8e2306b92dd
Author: jlauros <janne.lauros at csc.fi>
AuthorDate: Wed Dec 3 13:32:13 2025 +0200
Add check for code verifier length. Wrap Nimbus TokenRequest if it can be parsed
---
.../messaging/impl/OpenIDVCITokenRequest.java | 83 +++++++++-------------
1 file changed, 35 insertions(+), 48 deletions(-)
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequest.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequest.java
index 61bbae4..69a34d5 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequest.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCITokenRequest.java
@@ -30,6 +30,7 @@ import com.nimbusds.common.contenttype.ContentType;
import com.nimbusds.oauth2.sdk.AbstractOptionallyIdentifiedRequest;
import com.nimbusds.oauth2.sdk.OAuth2Error;
import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.oauth2.sdk.TokenRequest;
import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
import com.nimbusds.oauth2.sdk.http.HTTPRequest;
@@ -83,6 +84,10 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
@Nullable
private final List<OpenIDVCIAuthorizationDetail> authorizationDetails;
+ /** Request parsed as message understood by OP Token endpoint. */
+ @Nullable
+ private final TokenRequest opTokenRequest;
+
/**
* Constructor.
*
@@ -100,7 +105,7 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
public OpenIDVCITokenRequest(@Nullable final URI uri, @Nullable ClientAuthentication clientAuth,
@Nonnull String grantType, @Nullable String preAuthorizedCode, @Nullable String code,
@Nullable String txCode, @Nullable String codeVerifier,
- @Nullable List<OpenIDVCIAuthorizationDetail> authorizationDetails) {
+ @Nullable List<OpenIDVCIAuthorizationDetail> authorizationDetails, @Nullable TokenRequest opTokenRequest) {
super(uri, clientAuth);
if (grantTypeValuePreAuth.equals(grantType)) {
if (preAuthorizedCode == null || preAuthorizedCode.isEmpty()) {
@@ -115,13 +120,16 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
throw new IllegalArgumentException(
"Grant type must be either 'authorization_code' or 'urn:ietf:params:oauth:grant-type:pre-authorized_code'");
}
-
+ if (codeVerifier != null && codeVerifier.length() < 43) {
+ throw new IllegalArgumentException("The code verifier must be at least 43 characters");
+ }
this.grantType = grantType;
this.preAuthorizedCode = preAuthorizedCode;
this.code = code;
this.txCode = txCode;
this.codeVerifier = codeVerifier;
this.authorizationDetails = authorizationDetails;
+ this.opTokenRequest = opTokenRequest;
}
/**
@@ -141,8 +149,9 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
*/
public OpenIDVCITokenRequest(@Nullable final URI uri, @Nullable ClientID clientID, @Nonnull String grantType,
@Nullable String preAuthorizedCode, @Nullable String code, @Nullable String txCode,
- @Nullable String codeVerifier, @Nullable List<OpenIDVCIAuthorizationDetail> authorizationDetails) {
- super(uri, clientID);
+ @Nullable String codeVerifier, @Nullable List<OpenIDVCIAuthorizationDetail> authorizationDetails,
+ @Nullable TokenRequest opTokenRequest) {
+ super(uri, (ClientID) clientID);
if (grantTypeValuePreAuth.equals(grantType)) {
if (preAuthorizedCode == null || preAuthorizedCode.isEmpty()) {
throw new IllegalArgumentException(
@@ -156,45 +165,8 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
throw new IllegalArgumentException(
"Grant type must be either 'authorization_code' or 'urn:ietf:params:oauth:grant-type:pre-authorized_code'");
}
- this.grantType = grantType;
- this.preAuthorizedCode = preAuthorizedCode;
- this.code = code;
- this.txCode = txCode;
- this.codeVerifier = codeVerifier;
- this.authorizationDetails = authorizationDetails;
- }
-
- /**
- * Constructor.
- *
- * @param uri The URI of the endpoint (HTTP or HTTPS) for which
- * the request is intended, {@code null} if not
- * specified (if, for example, the
- * {@link #toHTTPRequest()} method will not be used).
- * @param clientID The client identifier, {@code null} if not
- * specified.
- * @param grantType Grant type.
- * @param preAuthorizedCode The pre-authorized code
- * @param code Authorization code
- * @param txCode The tx-code in pre-authorized flow
- * @param codeVerifier The PKCE code verifier
- */
- public OpenIDVCITokenRequest(@Nullable final URI uri, @Nonnull String grantType, @Nonnull String preAuthorizedCode,
- @Nullable String code, @Nullable String txCode, @Nullable String codeVerifier,
- @Nullable List<OpenIDVCIAuthorizationDetail> authorizationDetails) {
- super(uri, (ClientID) null);
- if (grantTypeValuePreAuth.equals(grantType)) {
- if (preAuthorizedCode == null || preAuthorizedCode.isEmpty()) {
- throw new IllegalArgumentException(
- "pre-auth code must not be null or empty for pre-authorized_code grant");
- }
- } else if (grantTypeValueCode.equals(grantType)) {
- if (code == null || code.isEmpty()) {
- throw new IllegalArgumentException("code must not be null or empty for authorization_code grant");
- }
- } else {
- throw new IllegalArgumentException(
- "Grant type must be either 'authorization_code' or 'urn:ietf:params:oauth:grant-type:pre-authorized_code'");
+ if (codeVerifier != null && codeVerifier.length() < 43) {
+ throw new IllegalArgumentException("The code verifier must be at least 43 characters");
}
this.grantType = grantType;
this.preAuthorizedCode = preAuthorizedCode;
@@ -202,6 +174,7 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
this.txCode = txCode;
this.codeVerifier = codeVerifier;
this.authorizationDetails = authorizationDetails;
+ this.opTokenRequest = opTokenRequest;
}
/**
@@ -264,6 +237,15 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
return authorizationDetails;
}
+ /**
+ * Get request parsed as message understood by OP Token endpoint.
+ *
+ * @return Request parsed as message understood by OP Token endpoint
+ */
+ public TokenRequest getOPTokenRequest() {
+ return opTokenRequest;
+ }
+
/**
* {@inheritDoc}
*/
@@ -306,7 +288,12 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
String txCode = MultivaluedMapUtils.getFirstValue(params, "tx_code");
String codeVerifier = MultivaluedMapUtils.getFirstValue(params, "code_verifier");
List<OpenIDVCIAuthorizationDetail> authorizationDetails = OpenIDVCIAuthorizationDetail.parse(httpRequest);
-
+ TokenRequest opTokenRequest = null;
+ try {
+ opTokenRequest = TokenRequest.parse(httpRequest);
+ } catch (ParseException e) {
+ // no-op. pre-authorize grant is not parsable.
+ }
URI uri;
try {
uri = httpRequest.getURL().toURI();
@@ -315,15 +302,15 @@ public class OpenIDVCITokenRequest extends AbstractOptionallyIdentifiedRequest {
}
if (clientAuth != null) {
return new OpenIDVCITokenRequest(uri, clientAuth, grantType, preAuthorizedCode, code, txCode, codeVerifier,
- authorizationDetails);
+ authorizationDetails, opTokenRequest);
}
final String clientIDString = MultivaluedMapUtils.getFirstValue(params, "client_id");
if (StringUtils.isBlank(clientIDString)) {
- return new OpenIDVCITokenRequest(uri, grantType, preAuthorizedCode, code, txCode, codeVerifier,
- authorizationDetails);
+ return new OpenIDVCITokenRequest(uri, (ClientID) null, grantType, preAuthorizedCode, code, txCode,
+ codeVerifier, authorizationDetails, opTokenRequest);
}
return new OpenIDVCITokenRequest(uri, new ClientID(clientIDString), grantType, preAuthorizedCode, code, txCode,
- codeVerifier, authorizationDetails);
+ codeVerifier, authorizationDetails, opTokenRequest);
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list