[jira] [Comment Edited] (CXF-6579) Inflated tokens can be corrupted if compression ratio is greater than 2:1

["Sergey Beryozkin (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CXF-6579?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14732491#comment-14732491 ] 

Sergey Beryozkin edited comment on CXF-6579 at 9/6/15 6:27 PM:
---------------------------------------------------------------

Thanks for the test, I've introduced a 'deflate.level' contextual property. At the moment the default is the Deflater.DEFLATE which can be set to 0, etc, if needed.

Should a level be set to 0 by default if no contextual property is available. I guess it might be sensitive if somehow we have a client or server having different deflate level expectations, so it is better be configurable, just not sure how sensitive it can be if we set it to 0 by default after the code used a different level...Probably should keep it as is but in in this case setting a 'deflate.level' to something else would fix it, Phillip, does it work for you ?


was (Author: sergey_beryozkin):
Thanks for the test, I've introduced a 'deflate.level' contextual property. At the moment the default is the Deflater.DEFLATE which can be set to 0, etc, if needed.

Should a level be set to 0 by default if no contextual property is available. I guess it might be sensitive if somehow we have a client or server having different deflate level expectations, so it is better be configurable, just not sure how sensitive it can be if we set it to 0 by default after the code used a different level...Probably should keep as is but in in this case setting a 'deflate.level' to something else would fix it, Phillip, does it fork for you ?

> Inflated tokens can be corrupted if compression ratio is greater than 2:1
> -------------------------------------------------------------------------
>
>                 Key: CXF-6579
>                 URL: https://issues.apache.org/jira/browse/CXF-6579
>             Project: CXF
>          Issue Type: Bug
>          Components: Core, JAX-RS Security
>    Affects Versions: 3.0.6, 2.7.17, 3.1.2
>            Reporter: Phillip Klinefelter
>            Priority: Critical
>
> DeflateEncoderDecoder/CompressionUtils inflate method assumes that the compression ratio will be 2:1.  That assumption is not true for SAML tokens with many similar attribute statements.  The inflated token will be corrupted with a portion of the token replaced with null characters.
> https://github.com/apache/cxf/blob/cxf-2.7.17/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/DeflateEncoderDecoder.java#L34
> https://github.com/apache/cxf/blob/cxf-3.0.6/core/src/main/java/org/apache/cxf/common/util/CompressionUtils.java#L41
> https://github.com/apache/cxf/blob/cxf-3.1.2/core/src/main/java/org/apache/cxf/common/util/CompressionUtils.java#L41
> {code}
>     @Test
>     public void testInflateDeflateWithTokenDuplication() throws Exception {
>         String token = "valid_grant valid_grant valid_grant valid_grant valid_grant valid_grant";
>         DeflateEncoderDecoder deflateEncoderDecoder = new DeflateEncoderDecoder();
>         byte[] deflatedToken = deflateEncoderDecoder.deflateToken(token.getBytes());
>         String cxfInflatedToken = IOUtils
>                 .toString(deflateEncoderDecoder.inflateToken(deflatedToken));
>         String streamInflatedToken = IOUtils.toString(
>                 new InflaterInputStream(new ByteArrayInputStream(deflatedToken),
>                         new Inflater(true)));
>         assertThat(streamInflatedToken, is(token));
>         assertThat(cxfInflatedToken, is(token));
>     }
> {code}
> The stream inflated token is correct but the CXF inflated token is invalid.
> {code}
> java.lang.AssertionError: 
> Expected: is "valid_grant valid_grant valid_grant valid_grant valid_grant valid_grant"
>      got: "t valid_grant valid_grant valid_grant"
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)