Repository: cxf Updated Branches: refs/heads/master 944bf866d -> 8cc74d421
Minor update to the collocated RequestAssertionService to prevent it reading regular POST form payloads and block PUT/etc requests Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/8cc74d42 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/8cc74d42 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/8cc74d42 Branch: refs/heads/master Commit: 8cc74d421498ba93a50d3ee5c4bd5e02b82470c5 Parents: 944bf86 Author: Sergey Beryozkin <[email protected]> Authored: Tue Apr 29 21:02:04 2014 +0100 Committer: Sergey Beryozkin <[email protected]> Committed: Tue Apr 29 21:02:04 2014 +0100 ---------------------------------------------------------------------- .../sso/RequestAssertionConsumerFilter.java | 25 +++++++++++++------- 1 file changed, 16 insertions(+), 9 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/8cc74d42/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/RequestAssertionConsumerFilter.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/RequestAssertionConsumerFilter.java b/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/RequestAssertionConsumerFilter.java index 3175ed2..e8c5c10 100644 --- a/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/RequestAssertionConsumerFilter.java +++ b/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/RequestAssertionConsumerFilter.java @@ -18,6 +18,7 @@ */ package org.apache.cxf.rs.security.saml.sso; +import java.io.ByteArrayInputStream; import java.io.IOException; import javax.annotation.Priority; @@ -28,7 +29,6 @@ import javax.ws.rs.container.ContainerRequestFilter; import javax.ws.rs.container.PreMatching; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.MultivaluedMap; -import javax.ws.rs.core.Response; import org.apache.cxf.helpers.IOUtils; import org.apache.cxf.jaxrs.utils.JAXRSUtils; @@ -38,24 +38,28 @@ import org.apache.cxf.jaxrs.utils.JAXRSUtils; public class RequestAssertionConsumerFilter extends AbstractRequestAssertionConsumerHandler implements ContainerRequestFilter { + private boolean supportPostBinding; + @Override public void filter(ContainerRequestContext ct) throws IOException { String httpMethod = ct.getMethod(); - if (HttpMethod.GET.equals(httpMethod)) { + if (HttpMethod.GET.equals(httpMethod) && !supportPostBinding) { MultivaluedMap<String, String> params = ct.getUriInfo().getQueryParameters(); processParams(ct, params, false); - } else if (HttpMethod.POST.equals(httpMethod) + } else if (HttpMethod.POST.equals(httpMethod) + && supportPostBinding && MediaType.APPLICATION_FORM_URLENCODED_TYPE.isCompatible(ct.getMediaType())) { String strForm = IOUtils.toString(ct.getEntityStream()); MultivaluedMap<String, String> params = JAXRSUtils.getStructuredParams(strForm, "&", false, false); - processParams(ct, params, true); - } else { - ct.abortWith(Response.status(400).build()); + if (!processParams(ct, params, true)) { + // restore the stream + ct.setEntityStream(new ByteArrayInputStream(strForm.getBytes())); + } } } - protected void processParams(ContainerRequestContext ct, + protected boolean processParams(ContainerRequestContext ct, MultivaluedMap<String, String> params, boolean postBinding) { String encodedSamlResponse = params.getFirst(SSOConstants.SAML_RESPONSE); @@ -63,10 +67,13 @@ public class RequestAssertionConsumerFilter extends AbstractRequestAssertionCons if (relayState == null && encodedSamlResponse == null) { // initial redirect to IDP has not happened yet, let the SAML authentication filter do it JAXRSUtils.getCurrentMessage().put(SSOConstants.RACS_IS_COLLOCATED, Boolean.TRUE); - return; + return false; } ct.abortWith(doProcessSamlResponse(encodedSamlResponse, relayState, postBinding)); - + return true; + } + public void setSupportPostBinding(boolean supportPostBinding) { + this.supportPostBinding = supportPostBinding; } }
