[cxf-fediz] branch master updated: FEDIZ-253 - Enforce that only http or https is allowed in the OIDC ClientRegistration page

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf-fediz.git


The following commit(s) were added to refs/heads/master by this push:
     new 1dac649  FEDIZ-253 - Enforce that only http or https is allowed in the 
OIDC ClientRegistration page
1dac649 is described below

commit 1dac649b6c8d511d16744eb9a82b0c79fb27f6a8
Author: Colm O hEigeartaigh <cohei...@apache.org>
AuthorDate: Tue Jan 5 08:45:24 2021 +0000

    FEDIZ-253 - Enforce that only http or https is allowed in the OIDC 
ClientRegistration page
---
 .../fediz/service/oidc/clients/ClientRegistrationService.java    | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git 
a/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/clients/ClientRegistrationService.java
 
b/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/clients/ClientRegistrationService.java
index 08eb8db..696b694 100644
--- 
a/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/clients/ClientRegistrationService.java
+++ 
b/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/clients/ClientRegistrationService.java
@@ -465,16 +465,15 @@ public class ClientRegistrationService {
 
     private static boolean isValidURI(String uri, boolean requireHttps) {
 
-        final UrlValidator urlValidator;
+        final String[] schemes;
 
         if (requireHttps) {
-            String[] schemes = {"https"};
-            urlValidator = new UrlValidator(schemes, 
UrlValidator.ALLOW_LOCAL_URLS);
+            schemes = new String[] {"https"};
         } else {
-            urlValidator = new UrlValidator(UrlValidator.ALLOW_LOCAL_URLS
-                                                     + 
UrlValidator.ALLOW_ALL_SCHEMES);
+            schemes = new String[] {"https", "http"};
         }
 
+        UrlValidator urlValidator = new UrlValidator(schemes, 
UrlValidator.ALLOW_LOCAL_URLS);
         if (!urlValidator.isValid(uri)) {
             return false;
         }