You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by re...@apache.org on 2026/07/02 13:02:41 UTC
(cxf) branch 3.6.x-fixes updated (924c082fadc -> 02676dbedf0)
This is an automated email from the ASF dual-hosted git repository.
reta pushed a change to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
from 924c082fadc Enforce scheme checks for decoupled destinations (#3266)
new 9282fdb4081 Bump org.webjars:swagger-ui from 5.32.6 to 5.32.8 (#3258)
new 4017478248f Bump actions/cache from 5.0.5 to 6.1.0 (#3262)
new dcc86b30314 Bump actions/setup-java from 5.3.0 to 5.4.0 (#3261)
new 99d4d283cc7 Respect the AsyncRequestProducer contract by properly implementing available() method (#3235)
new 6b5bdf45d65 Bump org.graalvm.buildtools:native-maven-plugin from 1.1.2 to 1.1.3 (#3269)
new 362aeab192a validate redirect origin in oidc rp sign-in completion (#3241)
new 02676dbedf0 Fix post-merge compilation issues
The 7 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/workflows/codeql-analysis.yml | 6 +-
.github/workflows/pull-request-build.yml | 4 +-
.../release/samples/jax_rs/graalvm_basic/pom.xml | 6 +-
.../src/main/release/samples/jaxws_graalvm/pom.xml | 6 +-
.../samples/jaxws_graalvm_dynamic/client/pom.xml | 2 +-
.../samples/jaxws_graalvm_dynamic/server/pom.xml | 2 +-
distribution/src/main/release/samples/pom.xml | 2 +-
parent/pom.xml | 2 +-
rt/rs/security/sso/oidc/pom.xml | 6 ++
.../oidc/rp/OidcRpAuthenticationFilter.java | 25 +++++
.../oidc/rp/OidcRpAuthenticationFilterTest.java | 106 +++++++++++++++++++++
.../hc5/CXFHttpAsyncRequestProducer.java | 2 +-
12 files changed, 157 insertions(+), 12 deletions(-)
create mode 100644 rt/rs/security/sso/oidc/src/test/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilterTest.java
(cxf) 01/07: Bump org.webjars:swagger-ui from 5.32.6 to 5.32.8 (#3258)
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 9282fdb40818e9dbb9e07edd1192e68680ef71e1
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Mon Jun 29 07:22:38 2026 -0400
Bump org.webjars:swagger-ui from 5.32.6 to 5.32.8 (#3258)
Bumps [org.webjars:swagger-ui](https://github.com/swagger-api/swagger-ui) from 5.32.6 to 5.32.8.
- [Release notes](https://github.com/swagger-api/swagger-ui/releases)
- [Commits](https://github.com/swagger-api/swagger-ui/compare/v5.32.6...v5.32.8)
---
updated-dependencies:
- dependency-name: org.webjars:swagger-ui
dependency-version: 5.32.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <su...@github.com>
Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
(cherry picked from commit 99c2a32ac891117ac020393414cc326bdbf65bf3)
---
distribution/src/main/release/samples/pom.xml | 2 +-
parent/pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/distribution/src/main/release/samples/pom.xml b/distribution/src/main/release/samples/pom.xml
index af9eef1305e..1b36e706a19 100644
--- a/distribution/src/main/release/samples/pom.xml
+++ b/distribution/src/main/release/samples/pom.xml
@@ -35,7 +35,7 @@
<cxf.jetty10.version>10.0.26</cxf.jetty10.version>
<cxf.netty.version>4.1.135.Final</cxf.netty.version>
<cxf.httpcomponents.client.version>4.5.14</cxf.httpcomponents.client.version>
- <cxf.swagger.ui.version>5.32.6</cxf.swagger.ui.version>
+ <cxf.swagger.ui.version>5.32.8</cxf.swagger.ui.version>
<cxf.tika.version>2.9.1</cxf.tika.version>
<cxf.tomcat.version>9.0.119</cxf.tomcat.version>
<cxf.lucene.version>9.12.3</cxf.lucene.version>
diff --git a/parent/pom.xml b/parent/pom.xml
index a9a71f81d57..0a629e06b20 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -211,7 +211,7 @@
<cxf.spring.security.version>5.8.16</cxf.spring.security.version>
<cxf.spring.version>5.3.39</cxf.spring.version>
<cxf.stax-ex.version>1.8.3</cxf.stax-ex.version>
- <cxf.swagger.ui.version>5.32.6</cxf.swagger.ui.version>
+ <cxf.swagger.ui.version>5.32.8</cxf.swagger.ui.version>
<cxf.swagger.v3.version>2.2.52</cxf.swagger.v3.version>
<cxf.swagger2.version>1.6.15</cxf.swagger2.version>
<cxf.swagger2.guava.version>32.1.3-jre</cxf.swagger2.guava.version>
(cxf) 05/07: Bump org.graalvm.buildtools:native-maven-plugin from 1.1.2 to 1.1.3 (#3269)
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 6b5bdf45d6573f713755674428734289a1eb4c2a
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Wed Jul 1 00:00:57 2026 -0400
Bump org.graalvm.buildtools:native-maven-plugin from 1.1.2 to 1.1.3 (#3269)
Bumps [org.graalvm.buildtools:native-maven-plugin](https://github.com/graalvm/native-build-tools) from 1.1.2 to 1.1.3.
- [Release notes](https://github.com/graalvm/native-build-tools/releases)
- [Commits](https://github.com/graalvm/native-build-tools/compare/1.1.2...1.1.3)
---
updated-dependencies:
- dependency-name: org.graalvm.buildtools:native-maven-plugin
dependency-version: 1.1.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <su...@github.com>
Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
(cherry picked from commit b6df51f2d477153c12f82510c8de120688f47bdd)
---
distribution/src/main/release/samples/jax_rs/graalvm_basic/pom.xml | 6 +++++-
distribution/src/main/release/samples/jaxws_graalvm/pom.xml | 6 +++++-
.../src/main/release/samples/jaxws_graalvm_dynamic/client/pom.xml | 2 +-
.../src/main/release/samples/jaxws_graalvm_dynamic/server/pom.xml | 2 +-
4 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/distribution/src/main/release/samples/jax_rs/graalvm_basic/pom.xml b/distribution/src/main/release/samples/jax_rs/graalvm_basic/pom.xml
index 80bf40650e9..68c4fa0a151 100644
--- a/distribution/src/main/release/samples/jax_rs/graalvm_basic/pom.xml
+++ b/distribution/src/main/release/samples/jax_rs/graalvm_basic/pom.xml
@@ -68,7 +68,7 @@
<plugin>
<groupId>org.graalvm.buildtools</groupId>
<artifactId>native-maven-plugin</artifactId>
- <version>1.1.1</version>
+ <version>1.1.3</version>
<executions>
<execution>
<goals>
@@ -126,7 +126,11 @@
<plugin>
<groupId>org.graalvm.buildtools</groupId>
<artifactId>native-maven-plugin</artifactId>
+<<<<<<< HEAD
<version>1.1.1</version>
+=======
+ <version>1.1.3</version>
+>>>>>>> 22985c3ffb8 (Bump org.graalvm.buildtools:native-maven-plugin from 1.1.2 to 1.1.3 (#3269))
<executions>
<execution>
<goals>
diff --git a/distribution/src/main/release/samples/jaxws_graalvm/pom.xml b/distribution/src/main/release/samples/jaxws_graalvm/pom.xml
index eb1ae0fad9d..909e79f051a 100644
--- a/distribution/src/main/release/samples/jaxws_graalvm/pom.xml
+++ b/distribution/src/main/release/samples/jaxws_graalvm/pom.xml
@@ -93,7 +93,7 @@
<plugin>
<groupId>org.graalvm.buildtools</groupId>
<artifactId>native-maven-plugin</artifactId>
- <version>1.1.1</version>
+ <version>1.1.3</version>
<executions>
<execution>
<goals>
@@ -147,7 +147,11 @@
<plugin>
<groupId>org.graalvm.buildtools</groupId>
<artifactId>native-maven-plugin</artifactId>
+<<<<<<< HEAD
<version>1.1.1</version>
+=======
+ <version>1.1.3</version>
+>>>>>>> 22985c3ffb8 (Bump org.graalvm.buildtools:native-maven-plugin from 1.1.2 to 1.1.3 (#3269))
<executions>
<execution>
<goals>
diff --git a/distribution/src/main/release/samples/jaxws_graalvm_dynamic/client/pom.xml b/distribution/src/main/release/samples/jaxws_graalvm_dynamic/client/pom.xml
index b1b876ff320..097bdee509d 100644
--- a/distribution/src/main/release/samples/jaxws_graalvm_dynamic/client/pom.xml
+++ b/distribution/src/main/release/samples/jaxws_graalvm_dynamic/client/pom.xml
@@ -41,7 +41,7 @@
<plugin>
<groupId>org.graalvm.buildtools</groupId>
<artifactId>native-maven-plugin</artifactId>
- <version>1.1.1</version>
+ <version>1.1.3</version>
<executions>
<execution>
<goals>
diff --git a/distribution/src/main/release/samples/jaxws_graalvm_dynamic/server/pom.xml b/distribution/src/main/release/samples/jaxws_graalvm_dynamic/server/pom.xml
index cafb30c185c..1ada524e806 100644
--- a/distribution/src/main/release/samples/jaxws_graalvm_dynamic/server/pom.xml
+++ b/distribution/src/main/release/samples/jaxws_graalvm_dynamic/server/pom.xml
@@ -68,7 +68,7 @@
<plugin>
<groupId>org.graalvm.buildtools</groupId>
<artifactId>native-maven-plugin</artifactId>
- <version>1.1.1</version>
+ <version>1.1.3</version>
<executions>
<execution>
<goals>
(cxf) 03/07: Bump actions/setup-java from 5.3.0 to 5.4.0 (#3261)
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit dcc86b30314873024618a3d6b7679685c48aa400
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Mon Jun 29 08:47:21 2026 -0400
Bump actions/setup-java from 5.3.0 to 5.4.0 (#3261)
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.3.0 to 5.4.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/ad2b38190b15e4d6bdf0c97fb4fca8412226d287...1bcf9fb12cf4aa7d266a90ae39939e61372fe520)
---
updated-dependencies:
- dependency-name: actions/setup-java
dependency-version: 5.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <su...@github.com>
Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
(cherry picked from commit a90163cc1e1b8958b9a6a511a15d7b2104669aad)
---
.github/workflows/codeql-analysis.yml | 4 ++--
.github/workflows/pull-request-build.yml | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index ebf307cde6b..27423a22bd0 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -37,13 +37,13 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
# We must fetch at least the immediate parents so that if this is
# a pull request then we can checkout the head.
fetch-depth: 2
- name: Setup JDK 11
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
with:
distribution: 'temurin'
java-version: '11'
diff --git a/.github/workflows/pull-request-build.yml b/.github/workflows/pull-request-build.yml
index 07a5cdca7b6..e46d8644c96 100644
--- a/.github/workflows/pull-request-build.yml
+++ b/.github/workflows/pull-request-build.yml
@@ -18,9 +18,9 @@ jobs:
pull-requests: read
timeout-minutes: 130
steps:
- - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v3.6.0
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Set up JDK 11
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+ uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
with:
java-version: '11'
distribution: 'temurin'
(cxf) 02/07: Bump actions/cache from 5.0.5 to 6.1.0 (#3262)
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 4017478248f1259449d43c782b666b0c69f402cd
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Mon Jun 29 07:23:05 2026 -0400
Bump actions/cache from 5.0.5 to 6.1.0 (#3262)
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9)
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <su...@github.com>
Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
(cherry picked from commit 5ff8fcf1317b813955e1326afad83cce33ffa4b2)
# Conflicts:
# .github/workflows/codeql-analysis.yml
---
.github/workflows/codeql-analysis.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 22e5311f9fb..ebf307cde6b 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -48,7 +48,7 @@ jobs:
distribution: 'temurin'
java-version: '11'
- name: Cache local Maven repository
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+ uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
(cxf) 07/07: Fix post-merge compilation issues
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 02676dbedf041037c3ef513638e0fc932bfbd995
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Thu Jul 2 09:02:22 2026 -0400
Fix post-merge compilation issues
Signed-off-by: Andriy Redko <dr...@gmail.com>
---
.../cxf/rs/security/oidc/rp/OidcRpAuthenticationFilterTest.java | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/rt/rs/security/sso/oidc/src/test/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilterTest.java b/rt/rs/security/sso/oidc/src/test/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilterTest.java
index 8b2eeba7729..60e6b1a34a5 100644
--- a/rt/rs/security/sso/oidc/src/test/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilterTest.java
+++ b/rt/rs/security/sso/oidc/src/test/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilterTest.java
@@ -21,10 +21,10 @@ package org.apache.cxf.rs.security.oidc.rp;
import java.lang.reflect.Method;
import java.net.URI;
-import jakarta.ws.rs.container.ContainerRequestContext;
-import jakarta.ws.rs.core.MultivaluedHashMap;
-import jakarta.ws.rs.core.MultivaluedMap;
-import jakarta.ws.rs.core.UriInfo;
+import javax.ws.rs.container.ContainerRequestContext;
+import javax.ws.rs.core.MultivaluedHashMap;
+import javax.ws.rs.core.MultivaluedMap;
+import javax.ws.rs.core.UriInfo;
import org.junit.Test;
(cxf) 06/07: validate redirect origin in oidc rp sign-in completion (#3241)
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 362aeab192a3d724e6a1280b8c5bea62076ba619
Author: Javid Khan <dx...@gmail.com>
AuthorDate: Thu Jul 2 05:44:52 2026 +0530
validate redirect origin in oidc rp sign-in completion (#3241)
* validate redirect origin in oidc rp sign-in completion
Signed-off-by: dxbjavid <dx...@gmail.com>
* harden redirect state in oidc rp filter rather than completion service
* derive same-origin base from request uri info instead of message context
* add filter test for state with scheme but no authority
Signed-off-by: Javid Khan <dx...@gmail.com>
---------
Signed-off-by: dxbjavid <dx...@gmail.com>
Signed-off-by: Javid Khan <dx...@gmail.com>
(cherry picked from commit d36cff46abfda921b72b15bd01116017cea4c5d7)
---
rt/rs/security/sso/oidc/pom.xml | 6 ++
.../oidc/rp/OidcRpAuthenticationFilter.java | 25 +++++
.../oidc/rp/OidcRpAuthenticationFilterTest.java | 106 +++++++++++++++++++++
3 files changed, 137 insertions(+)
diff --git a/rt/rs/security/sso/oidc/pom.xml b/rt/rs/security/sso/oidc/pom.xml
index b882d52f416..ad0cff2c102 100644
--- a/rt/rs/security/sso/oidc/pom.xml
+++ b/rt/rs/security/sso/oidc/pom.xml
@@ -62,6 +62,12 @@
<artifactId>junit</artifactId>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.mockito</groupId>
+ <artifactId>mockito-core</artifactId>
+ <version>${cxf.mockito.version}</version>
+ <scope>test</scope>
+ </dependency>
<dependency>
<groupId>org.hsqldb</groupId>
<artifactId>hsqldb</artifactId>
diff --git a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java
index 8f4add8a600..d99410609f3 100644
--- a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java
+++ b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java
@@ -116,8 +116,33 @@ public class OidcRpAuthenticationFilter implements ContainerRequestFilter {
rc.setEntityStream(new ByteArrayInputStream(StringUtils.toBytesUTF8(body)));
}
+ // The "state" carried here is read back by the sign-in completion service and returned
+ // as a redirect Location, so a caller-supplied value collides with the redirect query
+ // the filter itself writes. Anything that is not within this application's own origin is
+ // dropped, otherwise completion would become an open redirect.
+ String location = requestState.getFirst("state");
+ if (location != null && !isSameOrigin(rc, location)) {
+ requestState.remove("state");
+ }
return requestState;
}
+ private boolean isSameOrigin(ContainerRequestContext rc, String location) {
+ final URI uri;
+ try {
+ uri = URI.create(location);
+ } catch (IllegalArgumentException ex) {
+ return false;
+ }
+ if (uri.getScheme() == null && uri.getAuthority() == null) {
+ // a path-only reference is resolved by the browser against the current request
+ return true;
+ }
+ URI base = rc.getUriInfo().getAbsolutePath();
+ return uri.getScheme() != null
+ && uri.getScheme().equalsIgnoreCase(base.getScheme())
+ && uri.getAuthority() != null
+ && uri.getAuthority().equalsIgnoreCase(base.getAuthority());
+ }
public void setRedirectUri(String redirectUri) {
this.redirectUri = redirectUri;
}
diff --git a/rt/rs/security/sso/oidc/src/test/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilterTest.java b/rt/rs/security/sso/oidc/src/test/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilterTest.java
new file mode 100644
index 00000000000..8b2eeba7729
--- /dev/null
+++ b/rt/rs/security/sso/oidc/src/test/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilterTest.java
@@ -0,0 +1,106 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.rs.security.oidc.rp;
+
+import java.lang.reflect.Method;
+import java.net.URI;
+
+import jakarta.ws.rs.container.ContainerRequestContext;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.UriInfo;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class OidcRpAuthenticationFilterTest {
+
+ private static final URI ABSOLUTE_PATH = URI.create("https://app.example.com:8080/services/rp/complete");
+
+ @Test
+ public void testDropsCrossOriginState() {
+ MultivaluedMap<String, String> state = requestState("https://evil.example.com/phish");
+ assertFalse(state.containsKey("state"));
+ }
+
+ @Test
+ public void testDropsProtocolRelativeState() {
+ MultivaluedMap<String, String> state = requestState("//evil.example.com/phish");
+ assertFalse(state.containsKey("state"));
+ }
+
+ @Test
+ public void testDropsUserinfoHostConfusionState() {
+ MultivaluedMap<String, String> state = requestState("https://app.example.com:8080@evil.example.com/phish");
+ assertFalse(state.containsKey("state"));
+ }
+
+ @Test
+ public void testDropsNoAuthority() {
+ MultivaluedMap<String, String> state = requestState("http:/");
+ assertFalse(state.containsKey("state"));
+ }
+
+ @Test
+ public void testKeepsSameOriginState() {
+ MultivaluedMap<String, String> state = requestState("https://app.example.com:8080/services/protected");
+ assertTrue(state.containsKey("state"));
+ assertEquals("https://app.example.com:8080/services/protected", state.getFirst("state"));
+ }
+
+ @Test
+ public void testKeepsRelativeState() {
+ MultivaluedMap<String, String> state = requestState("/services/protected");
+ assertTrue(state.containsKey("state"));
+ assertEquals("/services/protected", state.getFirst("state"));
+ }
+
+ private MultivaluedMap<String, String> requestState(String stateLocation) {
+ MultivaluedMap<String, String> query = new MultivaluedHashMap<>();
+ query.putSingle("state", stateLocation);
+
+ UriInfo uriInfo = mock(UriInfo.class);
+ when(uriInfo.getQueryParameters(true)).thenReturn(query);
+ when(uriInfo.getAbsolutePath()).thenReturn(ABSOLUTE_PATH);
+
+ ContainerRequestContext rc = mock(ContainerRequestContext.class);
+ when(rc.getUriInfo()).thenReturn(uriInfo);
+ when(rc.getMediaType()).thenReturn(null);
+
+ return invokeToRequestState(new OidcRpAuthenticationFilter(), rc);
+ }
+
+ @SuppressWarnings("unchecked")
+ private static MultivaluedMap<String, String> invokeToRequestState(OidcRpAuthenticationFilter filter,
+ ContainerRequestContext rc) {
+ try {
+ Method method = OidcRpAuthenticationFilter.class.getDeclaredMethod("toRequestState",
+ ContainerRequestContext.class);
+ method.setAccessible(true);
+ return (MultivaluedMap<String, String>)method.invoke(filter, rc);
+ } catch (ReflectiveOperationException ex) {
+ throw new IllegalStateException(ex);
+ }
+ }
+}
(cxf) 04/07: Respect the AsyncRequestProducer contract by properly implementing available() method (#3235)
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 99d4d283cc76d3bd053344f4cdcfb9ab355a1be0
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Mon Jun 29 09:25:25 2026 -0400
Respect the AsyncRequestProducer contract by properly implementing available() method (#3235)
* Respect the AsyncRequestProducer contract by properly implementing available() method
* Address code review comments
(cherry picked from commit 6f8224e23d5e1b18bed17e4d7a24522849fb6823)
---
.../cxf/transport/http/asyncclient/hc5/CXFHttpAsyncRequestProducer.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/CXFHttpAsyncRequestProducer.java b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/CXFHttpAsyncRequestProducer.java
index 896dcfd68c4..83eed5276e9 100644
--- a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/CXFHttpAsyncRequestProducer.java
+++ b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/CXFHttpAsyncRequestProducer.java
@@ -94,7 +94,7 @@ public class CXFHttpAsyncRequestProducer implements AsyncRequestProducer {
@Override
public int available() {
- return 0;
+ return Integer.MAX_VALUE;
}
@Override