[java-shib-shared] 01/02: Add some more test cases to URISupportTest.

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-shib-shared.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-shared.git;a=commit;h=cd24ce37a2e1b22780ff3c45c5cd8915c3893e76

commit cd24ce37a2e1b22780ff3c45c5cd8915c3893e76
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Mar 21 15:28:24 2025 -0400

    Add some more test cases to URISupportTest.
---
 .../net/shibboleth/shared/net/URISupportTest.java  | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/shib-networking/src/test/java/net/shibboleth/shared/net/URISupportTest.java b/shib-networking/src/test/java/net/shibboleth/shared/net/URISupportTest.java
index 2665829f..f1486f9c 100644
--- a/shib-networking/src/test/java/net/shibboleth/shared/net/URISupportTest.java
+++ b/shib-networking/src/test/java/net/shibboleth/shared/net/URISupportTest.java
@@ -201,6 +201,28 @@ public class URISupportTest {
         queryString = "Foo=";
         param = URISupport.getRawQueryStringParameter(queryString, "Foo");
         Assert.assertEquals(param, "Foo=");
+
+        // Check for various malicious value cases
+        queryString = "EvilABC=123&Foo=Bar&XYZ=456";
+        param = URISupport.getRawQueryStringParameter(queryString, "ABC");
+        Assert.assertNull(param);
+
+        queryString = "ABC=123&EvilFoo=Bar&XYZ=456";
+        param = URISupport.getRawQueryStringParameter(queryString, "Foo");
+        Assert.assertNull(param);
+
+        queryString = "ABC=123&Foo=Bar&EvilXYZ=456";
+        param = URISupport.getRawQueryStringParameter(queryString, "XYZ");
+        Assert.assertNull(param);
+        
+        queryString = "EvilABC=123&Foo=Bar&XYZ=456&ABC=456";
+        param = URISupport.getRawQueryStringParameter(queryString, "ABC");
+        Assert.assertEquals(param, "ABC=456");
+
+        queryString = "ABC=123&EvilFoo=Bar&XYZ=456&Foo=Baz";
+        param = URISupport.getRawQueryStringParameter(queryString, "Foo");
+        Assert.assertEquals(param, "Foo=Baz");
+        
     }
 
     @Test public void testParseQueryString() {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.