[GitHub] [cxf-fediz] coheigea commented on a change in pull request #56: fix Attribute claim parsing when attribute name contains a space

[GitBox <gi...@apache.org>]

coheigea commented on a change in pull request #56:
URL: https://github.com/apache/cxf-fediz/pull/56#discussion_r439432505



##########
File path: plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
##########
@@ -332,12 +334,18 @@ public TokenValidatorResponse validateAndProcessToken(TokenValidatorRequest requ
                 // Value of Attribute Name not fully qualified
                 // if NameFormat is http://schemas.xmlsoap.org/ws/2005/05/identity/claims
                 // but ClaimType value must be fully qualified as Namespace attribute goes away
-                URI attrName = URI.create(attribute.getName());
+                String attributeName;
+                try {
+                    attributeName = URLEncoder.encode(attribute.getName(), "UTF-8");
+                } catch (UnsupportedEncodingException e) {
+                    attributeName = attribute.getName();
+                }
+                URI attrName = URI.create(attributeName);

Review comment:
       This approach is not going to work, as otherwise it will always URL encode values that are not supposed to be URL encoded. Instead something like this should work:
   
   URI attrName = parseAttributeName(attribute);
   ...
   private URI parseAttributeName(Attribute attribute) {
           try {
               return URI.create(attribute.getName());
           } catch (IllegalArgumentException ex) {
               // Maybe the attribute name has a space in it...
               try {
                   return URI.create(URLEncoder.encode(attribute.getName(), StandardCharsets.UTF_8.name()));
               } catch (UnsupportedEncodingException e) {
                   throw new IllegalStateException("Unsupported Claim type");
               }
           }
       }




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org