rootvector2 commented on PR #3654: URL: https://github.com/apache/cxf/pull/3654#issuecomment-6543104644
Done. `setAllowedRelayStateOrigins` now throws `IllegalArgumentException` unless each entry has a scheme and host and no user info, path, query or fragment, so `app.example.com` and `https://app.example.com/app` fail at startup. A trailing `/` counts as a path, and a host `java.net.URI` can't parse is rejected too. A null entry throws the same way, and a null list resets to the empty default instead of throwing an NPE. The ignored-RelayState log is now `FINE`, behind `isLoggable`. `testInvalidAllowedOriginIsRejected` covers each rejected form. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
