[java-plugin-shibd-saml] branch main updated: Tolerate quoted or unquoted PAOS options.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/028fe585d97de6888a26a936fef8ccb5dabb983f

The following commit(s) were added to refs/heads/main by this push:
     new 028fe58  Tolerate quoted or unquoted PAOS options.
028fe58 is described below

commit 028fe585d97de6888a26a936fef8ccb5dabb983f
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Tue Aug 11 11:30:21 2026 -0400

    Tolerate quoted or unquoted PAOS options.
---
 .../impl/ECPHttpServletRequestValidator.java       | 13 +++++++++---
 .../saml/saml2/profile/impl/ParseECPOptions.java   |  9 +++++++-
 .../saml2/profile/impl/ParseECPOptionsTest.java    | 24 ++++++++++++++++++++++
 3 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/binding/impl/ECPHttpServletRequestValidator.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/binding/impl/ECPHttpServletRequestValidator.java
index b528962..e172f88 100644
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/binding/impl/ECPHttpServletRequestValidator.java
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/binding/impl/ECPHttpServletRequestValidator.java
@@ -81,10 +81,17 @@ public class ECPHttpServletRequestValidator implements HttpServletRequestValidat
         final String paosService = paosHeader.substring(SAML2InitiatorConstants.PAOS_HEADER_VERSION_INDICATOR.length());
         if (paosService != null) {
             final String[] options = paosService.split(",");
-            if (options != null && options.length > 0 &&
-                    SAMLConstants.SAML20ECP_NS.equals(StringSupport.trimOrNull(options[0]))) {
-                return;
+            if (options != null && options.length > 0) {
+                String opt = StringSupport.trimOrNull(options[0]);
+                if (opt != null && opt.startsWith("\"") && opt.endsWith("\"")) {
+                    opt = opt.substring(1, opt.length() - 1);
+                }
+                
+                if (SAMLConstants.SAML20ECP_NS.equals(opt)) {
+                    return;
+                }
             }
+            
         }
         
         throw new ServletException("PAOS header missing required ECP service indicator.");
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ParseECPOptions.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ParseECPOptions.java
index a5918b9..64bfa7a 100644
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ParseECPOptions.java
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ParseECPOptions.java
@@ -39,6 +39,8 @@ import net.shibboleth.shared.primitive.StringSupport;
  * Action that parses a client's "PAOS" header to populate an {@link ECPOptionsContext} with its
  * flags.
  * 
+ * <p>Technically the header options have to be quoted, but we are a bit forgiving here.</p>
+ * 
  * @event {@link EventIds#PROCEED_EVENT_ID}
  * @event {@link EventIds#INVALID_MESSAGE}
  * @event {@link EventIds#INVALID_PROFILE_CTX}
@@ -115,11 +117,16 @@ public class ParseECPOptions extends AbstractApplicationAction {
         }
         
         for (int i = 1; i < options.length; ++i) {
-            final String opt = StringSupport.trimOrNull(options[i]);
+            String opt = StringSupport.trimOrNull(options[i]);
             if (opt == null) {
                 continue;
             }
             
+            // Strip quotes if they exist.
+            if (opt.startsWith("\"") && opt.endsWith("\"")) {
+                opt = opt.substring(1, opt.length() - 1);
+            }
+            
             switch (opt) {
                 case SAML2InitiatorConstants.ECP20_OPTION_WANT_AUTHN_REQUESTS_SIGNED:
                     optionsContext.setWantAuthnRequestsSigned(true);
diff --git a/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/impl/ParseECPOptionsTest.java b/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/impl/ParseECPOptionsTest.java
index 7c5af22..2c0b3de 100644
--- a/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/impl/ParseECPOptionsTest.java
+++ b/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/impl/ParseECPOptionsTest.java
@@ -110,6 +110,30 @@ public class ParseECPOptionsTest extends BaseApplicationActionTest {
         
         validateOptions(signed, cb, hok, del);
     }
+
+    @Test(dataProvider="flags")
+    public void testQuotedOptions(final boolean signed, final boolean cb, final boolean hok, final boolean del) {
+        final StringBuilder builder = new StringBuilder(SAML2InitiatorConstants.PAOS_HEADER_VERSION_INDICATOR + ' ' + SAMLConstants.SAML20ECP_NS);
+        if (signed) {
+            builder.append(", ").append('"').append(SAML2InitiatorConstants.ECP20_OPTION_WANT_AUTHN_REQUESTS_SIGNED).append('"');
+        }
+        if (cb) {
+            builder.append(",").append('"').append(SAML2InitiatorConstants.ECP20_OPTION_CHANNEL_BINDING).append('"');
+        }
+        if (hok) {
+            builder.append(",  ").append('"').append(SAML2InitiatorConstants.ECP20_OPTION_HOLDER_OF_KEY).append('"');
+        }
+        if (del) {
+            builder.append(",").append('"').append(SAML2InitiatorConstants.ECP20_OPTION_DELEGATION).append('"');
+        }
+        
+        addPAOSHeader(builder.toString());
+        
+        final Event event = action.execute(src);
+        ActionTestingSupport.assertProceedEvent(event);
+        
+        validateOptions(signed, cb, hok, del);
+    }
     
     @DataProvider(name = "flags")
     public Object[][] getFlags() throws Exception {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.