[java-plugin-shibd] branch main updated: Extend unit test with content analysis.
Scott Cantor
cantor.2 at osu.edu
Mon Oct 6 22:42:15 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=752f174894cdb97860042af277000f122b63c74c
The following commit(s) were added to refs/heads/main by this push:
new 752f174 Extend unit test with content analysis.
752f174 is described below
commit 752f174894cdb97860042af277000f122b63c74c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Oct 6 18:42:09 2025 -0400
Extend unit test with content analysis.
---
sp-server-impl/pom.xml | 6 +++
.../sp/profile/impl/RecoverPostData.java | 2 +-
.../src/main/resources/templates/sp/post-replay.vm | 3 +-
.../sp/profile/impl/RecoverPostDataTest.java | 61 +++++++++++++++++++++-
4 files changed, 68 insertions(+), 4 deletions(-)
diff --git a/sp-server-impl/pom.xml b/sp-server-impl/pom.xml
index 4bb9f94..747fb5b 100644
--- a/sp-server-impl/pom.xml
+++ b/sp-server-impl/pom.xml
@@ -168,6 +168,12 @@
<artifactId>spring-test</artifactId>
<scope>test</scope>
</dependency>
+
+ <dependency>
+ <groupId>org.jsoup</groupId>
+ <artifactId>jsoup</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
</project>
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/RecoverPostData.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/RecoverPostData.java
index 0ff8aaf..b0acad6 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/RecoverPostData.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/RecoverPostData.java
@@ -310,8 +310,8 @@ public class RecoverPostData extends AbstractApplicationAction {
context.put("response", response);
HttpServletSupport.addNoCacheHeaders(response);
+ HttpServletSupport.setUTF8Encoding(response);
HttpServletSupport.setContentType(response, "text/html");
- response.setCharacterEncoding(decoder.charset().name());
response.setStatus(HttpServletResponse.SC_OK);
try (final Writer out = new OutputStreamWriter(response.getOutputStream(), decoder.charset())) {
diff --git a/sp-server-impl/src/main/resources/templates/sp/post-replay.vm b/sp-server-impl/src/main/resources/templates/sp/post-replay.vm
index f536c47..acb1c25 100644
--- a/sp-server-impl/src/main/resources/templates/sp/post-replay.vm
+++ b/sp-server-impl/src/main/resources/templates/sp/post-replay.vm
@@ -9,13 +9,14 @@
## params - List<Pair<String,String>> - the HTML-encoded form parameter n-v pairs
##
#set ($onLoad="submitOnce()")
-#if ($cspDigester)$response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)'")#end
+$response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)'")
## Nonce for dynanmic scripts.
#set ($nonce = $cspNonce.generateIdentifier())
$response.addHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")
<!DOCTYPE html>
<html>
<head>
+ <meta charset="utf-8" />
#parse ( "/templates/sp/add-html-head-content.vm" )
<script #if ($nonce)nonce="$nonce"#end>
<!--
diff --git a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/RecoverPostDataTest.java b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/RecoverPostDataTest.java
index cd42f57..e5c0b4b 100644
--- a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/RecoverPostDataTest.java
+++ b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/RecoverPostDataTest.java
@@ -15,14 +15,21 @@
package net.shibboleth.sp.profile.impl;
import java.io.IOException;
+import java.nio.charset.StandardCharsets;
import java.security.NoSuchAlgorithmException;
import java.time.Duration;
import java.time.Instant;
+import java.util.List;
import javax.annotation.Nonnull;
import org.apache.velocity.app.VelocityEngine;
import org.apache.velocity.runtime.RuntimeConstants;
+import org.jsoup.Jsoup;
+import org.jsoup.nodes.Document;
+import org.jsoup.nodes.DocumentType;
+import org.jsoup.nodes.Element;
+import org.jsoup.nodes.Node;
import org.opensaml.storage.impl.MemoryStorageService;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
@@ -55,8 +62,7 @@ import net.shibboleth.sp.profile.SPConstants;
public class RecoverPostDataTest extends BaseAgplicationActionTest {
@Nonnull @NotEmpty private final static String TEST_STATE = "foo";
- @Nonnull @NotEmpty private final static String TEST_DATA = "foo=bar&zorkmid=a+b";
- @Nonnull @NotEmpty private final static String BAD_TEST_DATA = "foo=bar&zorkmid=a+b&bad=%EB%8C%04";
+ @Nonnull @NotEmpty private final static String TEST_DATA = "foo=bar&zorkmid=a+b&frobnitz=c:d";
private DDF input;
private MockHttpServletRequest request;
@@ -195,6 +201,57 @@ public class RecoverPostDataTest extends BaseAgplicationActionTest {
.getmember(RemotedHttpServletResponse.RESPONSE);
Assert.assertEquals(response.getmember(RemotedHttpServletResponse.STATUS).integer(), 200);
Assert.assertNotNull(response.getmember(RemotedHttpServletResponse.DATA).unsafe_string());
+
+ final String csp = remotedResponse.getHeader("Content-Security-Policy");
+ Assert.assertEquals(csp, "script-src-attr 'unsafe-hashes' 'sha256-QUELzAHdV++P19CMkEAcak3UT9o+BNLqUcqMMeVd4Pg='");
+
+ Assert.assertEquals(remotedResponse.getContentType(), "text/html", "Unexpected content type");
+ Assert.assertEquals("UTF-8", remotedResponse.getCharacterEncoding(), "Unexpected character encoding");
+ Assert.assertEquals(remotedResponse.getHeader("Cache-control"), "no-cache, no-store", "Unexpected cache controls");
+
+ final Document webDoc = Jsoup.parse(
+ new String(response.getmember(RemotedHttpServletResponse.DATA).unsafe_string(), StandardCharsets.UTF_8)
+ );
+
+ boolean sawDocType = false;
+ List<Node>nods = webDoc.childNodes();
+ for (Node node : nods) {
+ if (node instanceof DocumentType) {
+ sawDocType = true;
+ DocumentType documentType = (DocumentType)node;
+ Assert.assertEquals(documentType.attr("name"), "html");
+ Assert.assertEquals(documentType.attr("publicId"), "");
+ Assert.assertEquals(documentType.attr("systemId"), "");
+ }
+ }
+ Assert.assertTrue(sawDocType);
+
+ Element head = webDoc.selectFirst("html > head");
+ assert head != null;
+ Element metaCharSet = head.selectFirst("meta[charset]");
+ assert metaCharSet != null;
+ Assert.assertEquals(metaCharSet.attr("charset").toLowerCase(), "utf-8");
+
+ Element body = webDoc.selectFirst("html > body");
+ assert body != null;
+ Assert.assertEquals(body.attr("onload"), "submitOnce()");
+
+ Element form = body.selectFirst("form");
+ assert form != null;
+ Assert.assertEquals(form.attr("method").toLowerCase(), "post");
+ Assert.assertEquals(form.attr("action"), "https://sp.example.org/test.cgi");
+
+ Element field1 = form.selectFirst("input[name=foo]");
+ assert field1 != null;
+ Assert.assertEquals(field1.val(), "bar");
+
+ Element field2 = form.selectFirst("input[name=zorkmid]");
+ assert field2 != null;
+ Assert.assertEquals(field2.val(), "a b");
+
+ Element field3 = form.selectFirst("input[name=frobnitz]");
+ assert field3 != null;
+ Assert.assertEquals(field3.val(), "c:d");
}
/**
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list