coheigea commented on a change in pull request #56:
URL: https://github.com/apache/cxf-fediz/pull/56#discussion_r439432505
##########
File path:
plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
##########
@@ -332,12 +334,18 @@ public TokenValidatorResponse
validateAndProcessToken(TokenValidatorRequest requ
// Value of Attribute Name not fully qualified
// if NameFormat is
http://schemas.xmlsoap.org/ws/2005/05/identity/claims
// but ClaimType value must be fully qualified as Namespace
attribute goes away
- URI attrName = URI.create(attribute.getName());
+ String attributeName;
+ try {
+ attributeName = URLEncoder.encode(attribute.getName(),
"UTF-8");
+ } catch (UnsupportedEncodingException e) {
+ attributeName = attribute.getName();
+ }
+ URI attrName = URI.create(attributeName);
Review comment:
This approach is not going to work, as otherwise it will always URL
encode values that are not supposed to be URL encoded. Instead something like
this should work:
URI attrName = parseAttributeName(attribute);
...
private URI parseAttributeName(Attribute attribute) {
try {
return URI.create(attribute.getName());
} catch (IllegalArgumentException ex) {
// Maybe the attribute name has a space in it...
try {
return URI.create(URLEncoder.encode(attribute.getName(),
StandardCharsets.UTF_8.name()));
} catch (UnsupportedEncodingException e) {
throw new IllegalStateException("Unsupported Claim type");
}
}
}
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
