[cxf] branch 3.4.x-fixes updated: Make sure both a request + request_uri can't be specified

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 3.4.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/3.4.x-fixes by this push:
     new aee3bf2  Make sure both a request + request_uri can't be specified
aee3bf2 is described below

commit aee3bf291a7387cc492aa0dbdb0fb2af96687994
Author: Colm O hEigeartaigh <cohei...@apache.org>
AuthorDate: Wed Jan 6 10:38:21 2021 +0000

    Make sure both a request + request_uri can't be specified
    
    (cherry picked from commit aa789c5c4686597a7bdef2443909ab491fc2bc04)
---
 .../rs/security/oauth2/grants/code/JwtRequestCodeFilter.java | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JwtRequestCodeFilter.java
 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JwtRequestCodeFilter.java
index 29ac000..15fe40b 100644
--- 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JwtRequestCodeFilter.java
+++ 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JwtRequestCodeFilter.java
@@ -21,9 +21,11 @@ package org.apache.cxf.rs.security.oauth2.grants.code;
 import java.security.cert.X509Certificate;
 import java.util.List;
 import java.util.Map;
+import java.util.logging.Logger;
 
 import javax.ws.rs.core.MultivaluedMap;
 
+import org.apache.cxf.common.logging.LogUtils;
 import org.apache.cxf.helpers.CastUtils;
 import org.apache.cxf.jaxrs.client.WebClient;
 import org.apache.cxf.jaxrs.impl.MetadataMap;
@@ -42,23 +44,31 @@ import 
org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
 import org.apache.cxf.rt.security.crypto.CryptoUtils;
 
 public class JwtRequestCodeFilter extends OAuthJoseJwtConsumer implements 
AuthorizationRequestFilter {
+    protected static final Logger LOG = 
LogUtils.getL7dLogger(JwtRequestCodeFilter.class);
     private static final String REQUEST_URI_CONTENT_TYPE = 
"application/oauth-authz-req+jwt";
     private static final String REQUEST_PARAM = "request";
     private static final String REQUEST_URI_PARAM = "request_uri";
+
     private boolean verifyWithClientCertificates;
     private String issuer;
     private JsonMapObjectReaderWriter jsonHandler = new 
JsonMapObjectReaderWriter();
+
     @Override
     public MultivaluedMap<String, String> process(MultivaluedMap<String, 
String> params,
                                                   UserSubject endUser,
                                                   Client client) {
         String requestToken = params.getFirst(REQUEST_PARAM);
+        String requestUri = params.getFirst(REQUEST_URI_PARAM);
+
         if (requestToken == null) {
-            String requestUri = params.getFirst(REQUEST_URI_PARAM);
             if (isRequestUriValid(client, requestUri)) {
                 requestToken = 
WebClient.create(requestUri).accept(REQUEST_URI_CONTENT_TYPE).get(String.class);
             }
+        } else if (requestUri != null) {
+            LOG.warning("It is not valid to specify both a request and 
request_uri value");
+            throw new SecurityException();
         }
+
         if (requestToken != null) {
             JweDecryptionProvider theDecryptor = 
super.getInitializedDecryptionProvider(client.getClientSecret());
             JwsSignatureVerifier theSigVerifier = 
getInitializedSigVerifier(client);