[java-shib-shared] branch main updated: Add allowed params support to BasicHttpServletRequestParametersValidator

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-shib-shared.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-shared.git;a=commit;h=f2b6de9078086e12cdd60728ae040d15579894d6

The following commit(s) were added to refs/heads/main by this push:
     new f2b6de90 Add allowed params support to BasicHttpServletRequestParametersValidator
f2b6de90 is described below

commit f2b6de9078086e12cdd60728ae040d15579894d6
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Sat Mar 22 18:57:41 2025 -0400

    Add allowed params support to BasicHttpServletRequestParametersValidator
---
 ...BasicHttpServletRequestParametersValidator.java | 65 ++++++++++++++++++++++
 ...cHttpServletRequestParametersValidatorTest.java | 56 +++++++++++++++++++
 2 files changed, 121 insertions(+)

diff --git a/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/BasicHttpServletRequestParametersValidator.java b/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/BasicHttpServletRequestParametersValidator.java
index 80b0faa0..cbbc506b 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/BasicHttpServletRequestParametersValidator.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/BasicHttpServletRequestParametersValidator.java
@@ -42,6 +42,12 @@ public class BasicHttpServletRequestParametersValidator extends AbstractInitiali
     /** Logger. */
     @Nonnull private Logger log = LoggerFactory.getLogger(BasicHttpServletRequestParametersValidator.class);
     
+    /** Flag indicating whether to enforce the allowed parameters. */
+    private boolean enforceAllowedParameters = false;
+    
+    /** Allowed parameters. */
+    @Nonnull private Set<String> allowedParameters = CollectionSupport.emptySet();
+    
     /** Required parameters. */
     @Nonnull private Set<String> requiredParameters = CollectionSupport.emptySet();
     
@@ -51,6 +57,53 @@ public class BasicHttpServletRequestParametersValidator extends AbstractInitiali
     /** Mutually exclusive parameters. */
     @Nonnull private Set<Set<String>> mutuallyExclusiveParameters = CollectionSupport.emptySet();
 
+    /**
+     * Get flag indicating whether to enforce the allowed parameters. 
+     * 
+     * <p>Defaults to <code>false</code>.
+     * 
+     * @return flag indicating enforcement of allowed parameters
+     */
+    public boolean isEnforceAllowedParameters() {
+        return enforceAllowedParameters;
+    }
+
+    /**
+     * Set flag indicating whether to enforce the allowed parameters. 
+     * 
+     * <p>Defaults to <code>false</code>.
+     * 
+     * @param flag indicating enforcement of allowed parameters
+     */
+    public void setEnforceAllowedParameters(final boolean flag) {
+        checkSetterPreconditions();
+        enforceAllowedParameters = flag;
+    }
+
+
+    /**
+     * Get the allowed parameters. 
+     * 
+     * <p>When enforced, a request parameter not in the allowed set will be considered invalid.</p>
+     * 
+     * @return the allowed parameters
+     */
+    @Nonnull @Unmodifiable @NotLive public Set<String> getAllowedParameters() {
+        return allowedParameters;
+    }
+
+    /**
+     * Set the allowed parameters. 
+     * 
+     * <p>When enforced, a request parameter not in the allowed set will be considered invalid.</p>
+     * 
+     * @param params the allowed parameters
+     */
+    public void setAllowedParameters(@Nullable final Set<String> params) {
+        checkSetterPreconditions();
+        allowedParameters = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(params));
+    }
+
     /**
      * Get the required parameters. 
      * 
@@ -133,6 +186,18 @@ public class BasicHttpServletRequestParametersValidator extends AbstractInitiali
     public void validate(@Nonnull final HttpServletRequest request) throws ServletException {
         Constraint.isNotNull(request, "HttpServletRequest was null");
         final Set<String> requestParams = request.getParameterMap().keySet();
+        
+        if (isEnforceAllowedParameters()) {
+            log.debug("Evaluating request for allowed parameters: {}", getAllowedParameters());
+            for (final String requestParam : requestParams) {
+                if (!getAllowedParameters().contains(requestParam)) {
+                    log.warn("HTTP request contained a disallowed parameter: {}", requestParam);
+                    throw new ServletException("HTTP request contained a disallowed parameter: " + requestParam);
+                }
+            }
+        } else {
+            log.debug("Enforcement of allowed parameters is disabled");
+        }
 
         log.debug("Evaluating request for required parameters: {}", getRequiredParameters());
         for (final String param : getRequiredParameters()) {
diff --git a/shib-networking/src/test/java/net/shibboleth/shared/servlet/impl/BasicHttpServletRequestParametersValidatorTest.java b/shib-networking/src/test/java/net/shibboleth/shared/servlet/impl/BasicHttpServletRequestParametersValidatorTest.java
index 3ce4b909..9f1613ea 100644
--- a/shib-networking/src/test/java/net/shibboleth/shared/servlet/impl/BasicHttpServletRequestParametersValidatorTest.java
+++ b/shib-networking/src/test/java/net/shibboleth/shared/servlet/impl/BasicHttpServletRequestParametersValidatorTest.java
@@ -30,6 +30,26 @@ import net.shibboleth.shared.collection.Pair;
  */
 public class BasicHttpServletRequestParametersValidatorTest {
     
+    @DataProvider
+    Object[][] allowedParamsSetterData() {
+        return new Object[][] {
+            new Object[] { Set.of(),
+                    Set.of()},
+            new Object[] { Set.of("  Foo  ", "  Bar  ", "   "),
+                    Set.of("Foo", "Bar")},
+        };
+    }
+    
+    @Test(dataProvider="allowedParamsSetterData")
+    public void allowedSetter(Set<String> params, Set<String> expected) throws Exception {
+        BasicHttpServletRequestParametersValidator validator = new BasicHttpServletRequestParametersValidator();
+        validator.setAllowedParameters(params);
+        validator.initialize();
+        
+        Assert.assertEquals(validator.getAllowedParameters(), expected);
+    }
+    
+    
     @DataProvider
     Object[][] requiredParamsSetterData() {
         return new Object[][] {
@@ -89,6 +109,42 @@ public class BasicHttpServletRequestParametersValidatorTest {
         Assert.assertEquals(validator.getMutuallyExclusiveParameters(), expected);
     }
     
+    @DataProvider
+    Object[][] allowedParamsEvalData() {
+        return new Object[][] {
+            new Object[] { List.of(),
+                    Set.of(),
+                    true},
+            new Object[] { List.of(),
+                    Set.of("Foo"),
+                    true},
+            new Object[] { List.of(new Pair<>("Foo", new String[]{"abc"}), new Pair<>("Bar", new String[]{"def"})),
+                    Set.of(),
+                    false},
+            new Object[] { List.of(new Pair<>("Foo", new String[]{"abc"}), new Pair<>("Bar", new String[]{"def"})),
+                    Set.of("Foo"),
+                    false},
+            new Object[] { List.of(new Pair<>("Bar", new String[]{"def"}), new Pair<>("Bar", new String[]{"def"})),
+                    Set.of("Foo", "Bar"),
+                    true},
+        };
+    }
+    
+    @Test(dataProvider="allowedParamsEvalData")
+    public void allowedEval(List<Pair<String, String[]>> requestParams, Set<String> allowedParams, boolean valid) throws Exception {
+        // First test enforce disabled, so all requests should eval to valid
+        BasicHttpServletRequestParametersValidator validator = new BasicHttpServletRequestParametersValidator();
+        validator.setEnforceAllowedParameters(false);
+        validator.setAllowedParameters(allowedParams);
+        evaluateRequest(validator, "allowed", requestParams, true);
+
+        // Now test enforce enabled, do result is as test data arg indicates
+        validator = new BasicHttpServletRequestParametersValidator();
+        validator.setEnforceAllowedParameters(true);
+        validator.setAllowedParameters(allowedParams);
+        evaluateRequest(validator, "allowed", requestParams, valid);
+    }
+    
     @DataProvider
     Object[][] requiredParamsEvalData() {
         return new Object[][] {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.