shibboleth.Conditions.Scripted and User-Agent http header ?

[Jarno Huuskonen]

Hi,

On Fri, 2022-03-25 at 15:45 +0000, Cantor, Scott via users wrote:
> I used a Spring Expression for this, but there are equivalent ways to do
> it with a script. My SameSite condition is
> 
>     <bean id="osu.SameSiteExpression" class="java.util.regex.Pattern"
> factory-method="compile"
>         c:_0="(Firefox)|(Chrom(e|ium)/[1234789])" />
> 
>     <bean id="osu.SameSiteCondition"
> class="net.shibboleth.ext.spring.util.SpringExpressionPredicate"
>         c:expression="#custom.matcher(#input.getHeader('User-Agent') ?:
> '').find() and !(#input.getHeader('User-Agent') ?:
> '').contains('UCBrowser')"
>         p:customObject-ref="osu.SameSiteExpression" />
> 
> As I thought, the input here is the servlet request, nothing fancier.

Thanks,

I (think) I got it working with shibboleth.Conditions.Scripted:
    <bean id="UEF.SameSiteCondition" parent="shibboleth.Conditions.Scripted"
factory-method="resourceScript"
        p:returnOnError="true" p:hideExceptions="true"
        c:_0="javascript" c:_1="%{idp.home}/conf/samesite.js" />

and
samesite.js:
-----------------8<------------
// https://catchjs.com/Blog/SameSiteCookies
//
https://devblogs.microsoft.com/dotnet/upcoming-samesite-cookie-changes-in-asp-net-and-asp-net-core/
// https://gist.github.com/skoranda/d4c9a132c50e82db341c433a75e616df
function isOlderUcBrowser(ua) {
        var match = ua.match(/UCBrowser\/(\d+)\.(\d+)\.(\d+)\./);
        if (!match) return false;
        var major = parseInt(match[1]);
        var minor = parseInt(match[2]);
        var build = parseInt(match[3]);
        if (major != 12) return major < 12;
        if (minor != 13) return minor < 13;
        return build < 2;
}

var activate = true;
var logger =
Java.type("org.slf4j.LoggerFactory").getLogger("UEF.sameSiteCondition");
try {
        if (input != null) {
                var UA = input.getHeader("User-Agent");
                if (UA != null) {
                        logger.debug('SameSite condition UA: ' + UA);
                        if (UA.contains("iPhone OS 12_") ||
UA.contains("iPad; CPU OS 12_") ||
                                UA.contains("Chrome/5") ||
UA.contains("Chrome/6") ||
                                UA.contains("Chromium/5") ||
UA.contains("Chromium/6") ||
                                (UA.contains(" OS X 10_14") &&
                                ((UA.contains("Version/") &&
UA.contains("Safari")) ||
                                        UA.endsWith("(KHTML, like
Gecko)"))))
                        {
                                activate = false;
                        }
                        else {
                                // UC Browser < 12.13.2
                                if (UA.contains("UCBrowser/")) {
                                        activate = !isOlderUcBrowser(UA);
                                }
                        }
                }
        }
}
catch (e) {
        logger.debug('SameSite condition error: ' + e);
}
logger.debug('SameSite condition verdict: ' + activate);
activate;

-- 
Jarno Huuskonen