Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Replace Apache Commons Base64 Decoding 

Issue gh-10923
This commit is contained in:
Josh Cummings 2022-03-01 15:02:32 -07:00
parent 238616da80
commit 7a02bd14c1
5 changed files with 17 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java
View File

@ -293,7 +293,7 @@ public class Saml2LoginConfigurerTests {
public void authenticateWithInvalidDeflatedSAMLResponseThenFailureHandlerUses() throws Exception { public void authenticateWithInvalidDeflatedSAMLResponseThenFailureHandlerUses() throws Exception {
this.spring.register(CustomAuthenticationFailureHandler.class).autowire(); this.spring.register(CustomAuthenticationFailureHandler.class).autowire();
byte[] invalidDeflated = "invalid".getBytes(); byte[] invalidDeflated = "invalid".getBytes();
String encoded = Saml2Utils.samlEncode(invalidDeflated); String encoded = Saml2Utils.samlEncodeNotRfc2045(invalidDeflated);
MockHttpServletRequestBuilder request = get("/login/saml2/sso/registration-id").queryParam("SAMLResponse", MockHttpServletRequestBuilder request = get("/login/saml2/sso/registration-id").queryParam("SAMLResponse",
encoded); encoded);
this.mvc.perform(request); this.mvc.perform(request);

9
saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2Utils.java
View File

@ -19,13 +19,12 @@ package org.springframework.security.saml2.provider.service.authentication;
import java.io.ByteArrayOutputStream; import java.io.ByteArrayOutputStream;
import java.io.IOException; import java.io.IOException;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.util.Base64;
import java.util.zip.Deflater; import java.util.zip.Deflater;
import java.util.zip.DeflaterOutputStream; import java.util.zip.DeflaterOutputStream;
import java.util.zip.Inflater; import java.util.zip.Inflater;
import java.util.zip.InflaterOutputStream; import java.util.zip.InflaterOutputStream;
import org.apache.commons.codec.binary.Base64;
import org.springframework.security.saml2.Saml2Exception; import org.springframework.security.saml2.Saml2Exception;
/** /**
@ -33,17 +32,15 @@ import org.springframework.security.saml2.Saml2Exception;
*/ */
final class Saml2Utils { final class Saml2Utils {
private static Base64 BASE64 = new Base64(0, new byte[] { '\n' });
private Saml2Utils() { private Saml2Utils() {
} }
static String samlEncode(byte[] b) { static String samlEncode(byte[] b) {
return BASE64.encodeAsString(b); return Base64.getMimeEncoder().encodeToString(b);
} }
static byte[] samlDecode(String s) { static byte[] samlDecode(String s) {
return BASE64.decode(s); return Base64.getMimeDecoder().decode(s);
} }
static byte[] samlDeflate(String s) { static byte[] samlDeflate(String s) {

9
saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/Saml2Utils.java
View File

@ -19,13 +19,12 @@ package org.springframework.security.saml2.provider.service.web.authentication;
import java.io.ByteArrayOutputStream; import java.io.ByteArrayOutputStream;
import java.io.IOException; import java.io.IOException;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.util.Base64;
import java.util.zip.Deflater; import java.util.zip.Deflater;
import java.util.zip.DeflaterOutputStream; import java.util.zip.DeflaterOutputStream;
import java.util.zip.Inflater; import java.util.zip.Inflater;
import java.util.zip.InflaterOutputStream; import java.util.zip.InflaterOutputStream;
import org.apache.commons.codec.binary.Base64;
import org.springframework.security.saml2.Saml2Exception; import org.springframework.security.saml2.Saml2Exception;
/** /**
@ -37,17 +36,15 @@ import org.springframework.security.saml2.Saml2Exception;
*/ */
final class Saml2Utils { final class Saml2Utils {
private static Base64 BASE64 = new Base64(0, new byte[] { '\n' });
private Saml2Utils() { private Saml2Utils() {
} }
static String samlEncode(byte[] b) { static String samlEncode(byte[] b) {
return BASE64.encodeAsString(b); return Base64.getMimeEncoder().encodeToString(b);
} }
static byte[] samlDecode(String s) { static byte[] samlDecode(String s) {
return BASE64.decode(s); return Base64.getMimeDecoder().decode(s);
} }
static byte[] samlDeflate(String s) { static byte[] samlDeflate(String s) {

14
saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/core/Saml2Utils.java
View File

@ -19,28 +19,30 @@ package org.springframework.security.saml2.core;
import java.io.ByteArrayOutputStream; import java.io.ByteArrayOutputStream;
import java.io.IOException; import java.io.IOException;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.util.Base64;
import java.util.zip.Deflater; import java.util.zip.Deflater;
import java.util.zip.DeflaterOutputStream; import java.util.zip.DeflaterOutputStream;
import java.util.zip.Inflater; import java.util.zip.Inflater;
import java.util.zip.InflaterOutputStream; import java.util.zip.InflaterOutputStream;
import org.apache.commons.codec.binary.Base64;
import org.springframework.security.saml2.Saml2Exception; import org.springframework.security.saml2.Saml2Exception;
public final class Saml2Utils { public final class Saml2Utils {
private static Base64 BASE64 = new Base64(0, new byte[] { '\n' });
private Saml2Utils() { private Saml2Utils() {
} }
@Deprecated
public static String samlEncodeNotRfc2045(byte[] b) {
return Base64.getEncoder().encodeToString(b);
}
public static String samlEncode(byte[] b) { public static String samlEncode(byte[] b) {
return BASE64.encodeAsString(b); return Base64.getMimeEncoder().encodeToString(b);
} }
public static byte[] samlDecode(String s) { public static byte[] samlDecode(String s) {
return BASE64.decode(s); return Base64.getMimeDecoder().decode(s);
} }
public static byte[] samlDeflate(String s) { public static byte[] samlDeflate(String s) {

4
saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/Saml2AuthenticationTokenConverterTests.java
View File

@ -64,7 +64,7 @@ public class Saml2AuthenticationTokenConverterTests {
.willReturn(this.relyingPartyRegistration); .willReturn(this.relyingPartyRegistration);
MockHttpServletRequest request = new MockHttpServletRequest(); MockHttpServletRequest request = new MockHttpServletRequest();
request.setParameter(Saml2ParameterNames.SAML_RESPONSE, request.setParameter(Saml2ParameterNames.SAML_RESPONSE,
Saml2Utils.samlEncode("response".getBytes(StandardCharsets.UTF_8))); Saml2Utils.samlEncodeNotRfc2045("response".getBytes(StandardCharsets.UTF_8)));
Saml2AuthenticationToken token = converter.convert(request); Saml2AuthenticationToken token = converter.convert(request);
assertThat(token.getSaml2Response()).isEqualTo("response"); assertThat(token.getSaml2Response()).isEqualTo("response");
assertThat(token.getRelyingPartyRegistration().getRegistrationId()) assertThat(token.getRelyingPartyRegistration().getRegistrationId())
@ -115,7 +115,7 @@ public class Saml2AuthenticationTokenConverterTests {
MockHttpServletRequest request = new MockHttpServletRequest(); MockHttpServletRequest request = new MockHttpServletRequest();
request.setMethod("GET"); request.setMethod("GET");
byte[] deflated = Saml2Utils.samlDeflate("response"); byte[] deflated = Saml2Utils.samlDeflate("response");
String encoded = Saml2Utils.samlEncode(deflated); String encoded = Saml2Utils.samlEncodeNotRfc2045(deflated);
request.setParameter(Saml2ParameterNames.SAML_RESPONSE, encoded); request.setParameter(Saml2ParameterNames.SAML_RESPONSE, encoded);
Saml2AuthenticationToken token = converter.convert(request); Saml2AuthenticationToken token = converter.convert(request);
assertThat(token.getSaml2Response()).isEqualTo("response"); assertThat(token.getSaml2Response()).isEqualTo("response");