Sandor Molnar created KNOX-3551:
-----------------------------------
Summary: KnoxIDF: accepting consent fails with an NPE because the
consent state form field is lost
Key: KNOX-3551
URL: https://issues.apache.org/jira/browse/KNOX-3551
Project: Apache Knox
Issue Type: Improvement
Components: KnoxIDF
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
In the KnoxIDF authorization code flow, clicking *Accept* on the consent page
returns HTTP 500:
{code}
java.lang.NullPointerException: Cannot invoke "Object.hashCode()" because "key"
is null
at com.github.benmanes.caffeine.cache.LocalManualCache.getIfPresent(...)
at
org.apache.knox.gateway.util.knoxidf.KnoxIDFArtifactStore.get(KnoxIDFArtifactStore.java:41)
at
org.apache.knox.gateway.service.knoxidf.AuthorizeResource.consentAccepted(AuthorizeResource.java:405)
{code}
{{AuthConsentServlet}} sends the consent {{state}} as a hidden field in a form
POST ({{application/x-www-form-urlencoded}}).
{{AuthorizeResource.consentAccepted()}} reads it with
{{request.getParameter("state")}}. When the topology uses an identity-assertion
provider (e.g. {{Default}}), the request is wrapped by
{{IdentityAsserterHttpServletRequestWrapper}}. That wrapper reads and
re-encodes form bodies in {{getInputStream()}}, and once the body has been read
the container stops exposing form fields as servlet parameters. So {{state}}
comes back {{null}}, even from the unwrapped request. The {{null}} then goes to
the Caffeine-backed state store, which throws on null keys.
*Steps to reproduce:*
# Use a KnoxIDF SSO topology with an identity-assertion provider and
{{knoxidf.auto.consent.enabled=false}}.
# Start the flow at
{{/knoxidf/api/v1/authorize?response_type=code&client_id=...&state=...&scope=openid&redirect_uri=...}}.
# Click *Accept* on the consent page. The response is a 500 with the NPE above.
*Recommended fix:*
* Bind {{state}} in {{consentAccepted}} with JAX-RS {{@FormParam}} instead of
{{request.getParameter()}}.
* Return a 400 {{invalid_request}} when {{state}} is missing or blank.
* Make {{KnoxIDFArtifactStore.get()}} and {{remove()}} treat a null key as a
miss.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
