[java-identity-provider] 02/02: OSJ-427: Simple signature verification fails to detect parameter ...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=77934ab2aa3c3c67e25d630e5955a330590ffbfa

commit 77934ab2aa3c3c67e25d630e5955a330590ffbfa
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Mar 21 12:53:36 2025 -0400

    OSJ-427: Simple signature verification fails to detect parameter ...
    
    Wiring and MVC controller changes for HttpServletRequestValidator
    execution for SAML 2 AuthN flow.
---
 .../net/shibboleth/idp/conf/mvc-beans.xml          |  5 +++
 .../saml2/profile/impl/SAMLAuthnController.java    | 49 ++++++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml
index 3742bbcd3..df230f3cb 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml
@@ -60,8 +60,13 @@
         p:cSPDigester-ref="shibboleth.CSPDigester"
         p:cSPNonceGenerator-ref="shibboleth.CSPNonce" />
     <bean id="shibboleth.SAMLAuthnPOSTController" class="net.shibboleth.idp.saml.saml2.profile.impl.SAMLAuthnController"
+        p:validators-ref="shibboleth.SAMLAuthnPOSTController.HttpServletRequestValidatorMap"
         p:inboundBindings-ref="shibboleth.OutgoingSAML2SSOBindings" />
     <bean id="shibboleth.RaiseErrorController" class="net.shibboleth.shared.spring.error.ErrorRaisingController" />
+    
+    <util:map id="shibboleth.SAMLAuthnPOSTController.HttpServletRequestValidatorMap">
+        <entry key="POST" value-ref="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST" />
+    </util:map>
 
     <!-- Exception handling -->
     
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
index 7d870c0fc..d8ad608f0 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
@@ -38,11 +38,14 @@ import org.opensaml.saml.common.messaging.context.SAMLMessageReceivedEndpointCon
 import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.slf4j.Logger;
 import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.servlet.HttpServletRequestValidator;
+
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestMapping;
 
+import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import net.shibboleth.idp.authn.ExternalAuthentication;
@@ -80,6 +83,9 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
     /** Map of binding short names to deduce inbound binding constant. */
     @Nonnull private Map<String,BindingDescriptor> bindingMap;
     
+    /** Map of binding short names to HttpServletRequest validator. */
+    @Nonnull private Map<String,HttpServletRequestValidator> validatorMap;
+    
     /** Constructor. */
     public SAMLAuthnController() {
         // PRC -> AC -> nested PRC
@@ -97,6 +103,8 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
         samlContextLookupStrategy = scls;
         
         bindingMap = CollectionSupport.emptyMap();
+
+        validatorMap = CollectionSupport.emptyMap();
     }
     
     /**
@@ -136,6 +144,21 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
             bindingMap = CollectionSupport.emptyMap();
         }
     }
+    
+    /**
+     * Set the HTTP request validators.
+     * 
+     * @param validators the validators map
+     */
+    public void setValidators(@Nullable final Map<String,HttpServletRequestValidator> validators) {
+        checkSetterPreconditions();
+        if (validators != null) {
+            validatorMap = CollectionSupport.copyToMap(validators);
+        } else {
+            validatorMap = CollectionSupport.emptyMap();
+        }
+        
+    }
 
 // Checkstyle: CyclomaticComplexity OFF
     /**
@@ -229,6 +252,8 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
             @Nonnull final HttpServletResponse httpResponse, @PathVariable @Nonnull @NotEmpty final String binding)
                     throws ExternalAuthenticationException, IOException {
         
+        validateRequest(httpRequest, binding);
+        
         final String key = httpRequest.getParameter("RelayState");
         if (key == null) {
             throw new ExternalAuthenticationException("No RelayState parameter, unable to resume flow execution");
@@ -273,5 +298,29 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
         
         ExternalAuthentication.finishExternalAuthentication(key, httpRequest, httpResponse);
     }
+
+    /**
+     * Validate the inbound HTTP request.
+     * 
+     * @param httpRequest the request to validate
+     * @param binding a key for the inbound binding
+     * 
+     * @throws ExternalAuthenticationException if the request is determined to be invalid
+     */
+    private void validateRequest(@Nonnull final HttpServletRequest httpRequest, @Nonnull final String binding)
+            throws ExternalAuthenticationException {
+
+        final HttpServletRequestValidator validator = validatorMap.get(binding);
+        if (validator != null) {
+            try {
+                validator.validate(httpRequest);
+            } catch (final ServletException e) {
+                throw new ExternalAuthenticationException("HttpServletRequest failed validation", e);
+            }
+        } else {
+            log.warn("No HTTP request validator registered for inbound binding '{}', skipping evaluation", binding);
+        }
+
+    }
     
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.