[java-plugin-shibd] branch main updated: Switch request body from safe to unsafe string data.
Scott Cantor
cantor.2 at osu.edu
Tue Feb 4 19:06:52 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=63bbe13982678a2796d780ba37078131b5bf94d8
The following commit(s) were added to refs/heads/main by this push:
new 63bbe13 Switch request body from safe to unsafe string data.
63bbe13 is described below
commit 63bbe13982678a2796d780ba37078131b5bf94d8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 4 14:06:47 2025 -0500
Switch request body from safe to unsafe string data.
---
.../sp/messaging/RemotedHttpServletRequest.java | 17 +++++++++++------
.../messaging/impl/RemotedHttpServletRequestTest.java | 16 +++++++++-------
2 files changed, 20 insertions(+), 13 deletions(-)
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletRequest.java b/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletRequest.java
index f58e3ab..0d85e70 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletRequest.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletRequest.java
@@ -18,6 +18,7 @@ import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
+import java.io.InputStreamReader;
import java.io.StringReader;
import java.io.UnsupportedEncodingException;
import java.nio.ByteBuffer;
@@ -65,6 +66,7 @@ import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.net.URISupport;
import net.shibboleth.sp.ddf.DDF;
+import com.google.common.base.Charsets;
import com.google.common.collect.ArrayListMultimap;
import com.google.common.collect.Multimap;
@@ -189,10 +191,9 @@ public class RemotedHttpServletRequest implements HttpServletRequest {
/** {@inheritDoc} */
public ServletInputStream getInputStream() throws IOException {
- final String body = obj.getmember(BODY).string();
+ final byte[] body = obj.getmember(BODY).unsafe_string();
if (body != null) {
- // The body is always assumed to be safely encoded for our use cases.
- return new BodyInputStream(body.getBytes(StandardCharsets.UTF_8));
+ return new BodyInputStream(body);
}
return new BodyInputStream(EMPTY_BODY);
}
@@ -231,9 +232,10 @@ public class RemotedHttpServletRequest implements HttpServletRequest {
}
if ("application/x-www-form-urlencoded".equals(getContentType())) {
- final String body = obj.getmember("body").string();
+ final byte[] body = obj.getmember("body").unsafe_string();
if (body != null) {
- final List<Pair<String,String>> qparams = URISupport.parseQueryString(body);
+ final List<Pair<String,String>> qparams =
+ URISupport.parseQueryString(new String(body, Charsets.UTF_8));
for (final Pair<String,String> p : qparams) {
multimap.put(p.getFirst(), p.getSecond());
}
@@ -289,7 +291,10 @@ public class RemotedHttpServletRequest implements HttpServletRequest {
/** {@inheritDoc} */
public BufferedReader getReader() throws IOException {
- return new BufferedReader(new StringReader(obj.getmember(BODY).string()));
+ return new BufferedReader(
+ new InputStreamReader(
+ new ByteArrayInputStream(
+ obj.getmember(BODY).unsafe_string()), Charsets.UTF_8));
}
/** {@inheritDoc} */
diff --git a/sp-server-impl/src/test/java/net/shibboleth/sp/messaging/impl/RemotedHttpServletRequestTest.java b/sp-server-impl/src/test/java/net/shibboleth/sp/messaging/impl/RemotedHttpServletRequestTest.java
index 0e2436a..2cb7619 100644
--- a/sp-server-impl/src/test/java/net/shibboleth/sp/messaging/impl/RemotedHttpServletRequestTest.java
+++ b/sp-server-impl/src/test/java/net/shibboleth/sp/messaging/impl/RemotedHttpServletRequestTest.java
@@ -27,6 +27,8 @@ import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import org.testng.reporters.Files;
+import com.google.common.base.Charsets;
+
/**
* Unit test for {@link RemotedHttpServletRequest}.
*/
@@ -67,13 +69,13 @@ public class RemotedHttpServletRequestTest {
obj.addmember("content_length").integer(100);
obj.addmember("content_type").string("text/xml");
obj.addmember("method").string("POST");
- obj.addmember("body").string("<foo/>");
+ obj.addmember("body").unsafe_string("<foo/>".getBytes(Charsets.UTF_8));
obj.addmember("port").integer(80);
obj.addmember("remote_addr").string("127.0.0.1");
obj.addmember("remote_user").string("jdoe");
- obj.addmember("hostname").unsafe_string("localhost".getBytes("UTF-8"));
- obj.addmember("uri").unsafe_string("/endpoint".getBytes("UTF-8"));
- obj.addmember("url").unsafe_string("http://localhost/endpoint".getBytes("UTF-8"));
+ obj.addmember("hostname").unsafe_string("localhost".getBytes(Charsets.UTF_8));
+ obj.addmember("uri").unsafe_string("/endpoint".getBytes(Charsets.UTF_8));
+ obj.addmember("url").unsafe_string("http://localhost/endpoint".getBytes(Charsets.UTF_8));
obj.addmember("scheme").string("http");
assertEquals(req.getContentLength(), 100);
@@ -98,7 +100,7 @@ public class RemotedHttpServletRequestTest {
public void testOneQueryParameter() throws IOException {
obj.structure();
obj.addmember("content_type").string("text/xml");
- obj.addmember("body").string("<foo/>");
+ obj.addmember("body").unsafe_string("<foo/>".getBytes(Charsets.UTF_8));
obj.addmember("query").string("foo=bar+baz");
assertEquals(req.getParameterNames().nextElement(), "foo");
@@ -109,7 +111,7 @@ public class RemotedHttpServletRequestTest {
public void testMultiQueryParameters() throws IOException {
obj.structure();
obj.addmember("content_type").string("text/xml");
- obj.addmember("body").string("<foo/>");
+ obj.addmember("body").unsafe_string("<foo/>".getBytes(Charsets.UTF_8));
obj.addmember("query").string("foo=bar+baz&zork=grue&foo=baf");
assertEquals(req.getParameter("foo"), "bar baz");
@@ -121,7 +123,7 @@ public class RemotedHttpServletRequestTest {
public void testFormParameters() throws IOException {
obj.structure();
obj.addmember("content_type").string("application/x-www-form-urlencoded");
- obj.addmember("body").string("foo=baf");
+ obj.addmember("body").unsafe_string("foo=baf".getBytes(Charsets.UTF_8));
obj.addmember("query").string("foo=bar+baz&zork=grue");
assertEquals(req.getParameter("foo"), "bar baz");
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list