[
https://issues.apache.org/jira/browse/KNOX-3551?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18138636#comment-18138636
]
ASF subversion and git services commented on KNOX-3551:
-------------------------------------------------------
Commit d9ad14a1166db75a8a5b20f9d981e65755d795b2 in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=d9ad14a11 ]
KNOX-3551: KnoxIDF: bind the consent state as a form param so accepting consent
no longer NPEs (#1490)
> KnoxIDF: accepting consent fails with an NPE because the consent state form
> field is lost
> -----------------------------------------------------------------------------------------
>
> Key: KNOX-3551
> URL: https://issues.apache.org/jira/browse/KNOX-3551
> Project: Apache Knox
> Issue Type: Improvement
> Components: KnoxIDF
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> In the KnoxIDF authorization code flow, clicking *Accept* on the consent page
> returns HTTP 500:
> {code}
> java.lang.NullPointerException: Cannot invoke "Object.hashCode()" because
> "key" is null
> at com.github.benmanes.caffeine.cache.LocalManualCache.getIfPresent(...)
> at
> org.apache.knox.gateway.util.knoxidf.KnoxIDFArtifactStore.get(KnoxIDFArtifactStore.java:41)
> at
> org.apache.knox.gateway.service.knoxidf.AuthorizeResource.consentAccepted(AuthorizeResource.java:405)
> {code}
> {{AuthConsentServlet}} sends the consent {{state}} as a hidden field in a
> form POST ({{application/x-www-form-urlencoded}}).
> {{AuthorizeResource.consentAccepted()}} reads it with
> {{request.getParameter("state")}}. When the topology uses an
> identity-assertion provider (e.g. {{Default}}), the request is wrapped by
> {{IdentityAsserterHttpServletRequestWrapper}}. That wrapper reads and
> re-encodes form bodies in {{getInputStream()}}, and once the body has been
> read the container stops exposing form fields as servlet parameters. So
> {{state}} comes back {{null}}, even from the unwrapped request. The {{null}}
> then goes to the Caffeine-backed state store, which throws on null keys.
> *Steps to reproduce:*
> # Use a KnoxIDF SSO topology with an identity-assertion provider and
> {{knoxidf.auto.consent.enabled=false}}.
> # Start the flow at
> {{/knoxidf/api/v1/authorize?response_type=code&client_id=...&state=...&scope=openid&redirect_uri=...}}.
> # Click *Accept* on the consent page. The response is a 500 with the NPE
> above.
> *Recommended fix:*
> * Bind {{state}} in {{consentAccepted}} with JAX-RS {{@FormParam}} instead of
> {{request.getParameter()}}.
> * Return a 400 {{invalid_request}} when {{state}} is missing or blank.
> * Make {{KnoxIDFArtifactStore.get()}} and {{remove()}} treat a null key as a
> miss.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
