You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by se...@apache.org on 2014/04/29 22:02:33 UTC
git commit: Minor update to the collocated RequestAssertionService to
prevent it reading regular POST form payloads and block PUT/etc requests
Repository: cxf
Updated Branches:
refs/heads/master 944bf866d -> 8cc74d421
Minor update to the collocated RequestAssertionService to prevent it reading regular POST form payloads and block PUT/etc requests
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/8cc74d42
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/8cc74d42
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/8cc74d42
Branch: refs/heads/master
Commit: 8cc74d421498ba93a50d3ee5c4bd5e02b82470c5
Parents: 944bf86
Author: Sergey Beryozkin <sb...@talend.com>
Authored: Tue Apr 29 21:02:04 2014 +0100
Committer: Sergey Beryozkin <sb...@talend.com>
Committed: Tue Apr 29 21:02:04 2014 +0100
----------------------------------------------------------------------
.../sso/RequestAssertionConsumerFilter.java | 25 +++++++++++++-------
1 file changed, 16 insertions(+), 9 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/8cc74d42/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/RequestAssertionConsumerFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/RequestAssertionConsumerFilter.java b/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/RequestAssertionConsumerFilter.java
index 3175ed2..e8c5c10 100644
--- a/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/RequestAssertionConsumerFilter.java
+++ b/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/RequestAssertionConsumerFilter.java
@@ -18,6 +18,7 @@
*/
package org.apache.cxf.rs.security.saml.sso;
+import java.io.ByteArrayInputStream;
import java.io.IOException;
import javax.annotation.Priority;
@@ -28,7 +29,6 @@ import javax.ws.rs.container.ContainerRequestFilter;
import javax.ws.rs.container.PreMatching;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.MultivaluedMap;
-import javax.ws.rs.core.Response;
import org.apache.cxf.helpers.IOUtils;
import org.apache.cxf.jaxrs.utils.JAXRSUtils;
@@ -38,24 +38,28 @@ import org.apache.cxf.jaxrs.utils.JAXRSUtils;
public class RequestAssertionConsumerFilter extends AbstractRequestAssertionConsumerHandler
implements ContainerRequestFilter {
+ private boolean supportPostBinding;
+
@Override
public void filter(ContainerRequestContext ct) throws IOException {
String httpMethod = ct.getMethod();
- if (HttpMethod.GET.equals(httpMethod)) {
+ if (HttpMethod.GET.equals(httpMethod) && !supportPostBinding) {
MultivaluedMap<String, String> params = ct.getUriInfo().getQueryParameters();
processParams(ct, params, false);
- } else if (HttpMethod.POST.equals(httpMethod)
+ } else if (HttpMethod.POST.equals(httpMethod)
+ && supportPostBinding
&& MediaType.APPLICATION_FORM_URLENCODED_TYPE.isCompatible(ct.getMediaType())) {
String strForm = IOUtils.toString(ct.getEntityStream());
MultivaluedMap<String, String> params = JAXRSUtils.getStructuredParams(strForm, "&", false, false);
- processParams(ct, params, true);
- } else {
- ct.abortWith(Response.status(400).build());
+ if (!processParams(ct, params, true)) {
+ // restore the stream
+ ct.setEntityStream(new ByteArrayInputStream(strForm.getBytes()));
+ }
}
}
- protected void processParams(ContainerRequestContext ct,
+ protected boolean processParams(ContainerRequestContext ct,
MultivaluedMap<String, String> params,
boolean postBinding) {
String encodedSamlResponse = params.getFirst(SSOConstants.SAML_RESPONSE);
@@ -63,10 +67,13 @@ public class RequestAssertionConsumerFilter extends AbstractRequestAssertionCons
if (relayState == null && encodedSamlResponse == null) {
// initial redirect to IDP has not happened yet, let the SAML authentication filter do it
JAXRSUtils.getCurrentMessage().put(SSOConstants.RACS_IS_COLLOCATED, Boolean.TRUE);
- return;
+ return false;
}
ct.abortWith(doProcessSamlResponse(encodedSamlResponse, relayState, postBinding));
-
+ return true;
+ }
+ public void setSupportPostBinding(boolean supportPostBinding) {
+ this.supportPostBinding = supportPostBinding;
}
}