From 8953f464fb2d50dde2a8e783e919b0f3b158b1ee Mon Sep 17 00:00:00 2001 From: Tran Ngoc Nhan Date: Wed, 14 May 2025 16:54:52 +0700 Subject: [PATCH] Add Switch for Processing GET Requests Closes gh-17099 Signed-off-by: Tran Ngoc Nhan --- .../Saml2AuthenticationTokenConverter.java | 23 +++++++++++++++---- ...aml2AuthenticationTokenConverterTests.java | 17 +++++++++++++- 2 files changed, 34 insertions(+), 6 deletions(-) diff --git a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/Saml2AuthenticationTokenConverter.java b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/Saml2AuthenticationTokenConverter.java index 8acc64bf97..73872bbe03 100644 --- a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/Saml2AuthenticationTokenConverter.java +++ b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/Saml2AuthenticationTokenConverter.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2022 the original author or authors. + * Copyright 2002-2025 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -43,6 +43,8 @@ public final class Saml2AuthenticationTokenConverter implements AuthenticationCo private Saml2AuthenticationRequestRepository authenticationRequestRepository; + private boolean shouldConvertGetRequests = true; + /** * Constructs a {@link Saml2AuthenticationTokenConverter} given a strategy for * resolving {@link RelyingPartyRegistration}s @@ -86,16 +88,27 @@ public final class Saml2AuthenticationTokenConverter implements AuthenticationCo this.authenticationRequestRepository = authenticationRequestRepository; } + /** + * Use the given {@code shouldConvertGetRequests} to convert {@code GET} requests. + * Default is {@code true}. + * @param shouldConvertGetRequests the {@code shouldConvertGetRequests} to use + * @since 7.0 + */ + public void setShouldConvertGetRequests(boolean shouldConvertGetRequests) { + this.shouldConvertGetRequests = shouldConvertGetRequests; + } + private String decode(HttpServletRequest request) { String encoded = request.getParameter(Saml2ParameterNames.SAML_RESPONSE); if (encoded == null) { return null; } + boolean isGet = HttpMethod.GET.matches(request.getMethod()); + if (!this.shouldConvertGetRequests && isGet) { + return null; + } try { - return Saml2Utils.withEncoded(encoded) - .requireBase64(true) - .inflate(HttpMethod.GET.matches(request.getMethod())) - .decode(); + return Saml2Utils.withEncoded(encoded).requireBase64(true).inflate(isGet).decode(); } catch (Exception ex) { throw new Saml2AuthenticationException(new Saml2Error(Saml2ErrorCodes.INVALID_RESPONSE, ex.getMessage()), diff --git a/saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/Saml2AuthenticationTokenConverterTests.java b/saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/Saml2AuthenticationTokenConverterTests.java index f54788a4ea..b023d38cb6 100644 --- a/saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/Saml2AuthenticationTokenConverterTests.java +++ b/saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/Saml2AuthenticationTokenConverterTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2021 the original author or authors. + * Copyright 2002-2025 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -230,6 +230,21 @@ public class Saml2AuthenticationTokenConverterTests { .isThrownBy(() -> converter.setAuthenticationRequestRepository(null)); } + @Test + public void shouldNotConvertGetRequests() { + Saml2AuthenticationTokenConverter converter = new Saml2AuthenticationTokenConverter( + this.relyingPartyRegistrationResolver); + converter.setShouldConvertGetRequests(false); + given(this.relyingPartyRegistrationResolver.resolve(any(HttpServletRequest.class), any())) + .willReturn(this.relyingPartyRegistration); + MockHttpServletRequest request = new MockHttpServletRequest(); + request.setMethod("GET"); + request.setParameter(Saml2ParameterNames.SAML_RESPONSE, + Saml2Utils.samlEncode("response".getBytes(StandardCharsets.UTF_8))); + Saml2AuthenticationToken token = converter.convert(request); + assertThat(token).isNull(); + } + private void validateSsoCircleXml(String xml) { assertThat(xml).contains("InResponseTo=\"ARQ9a73ead-7dcf-45a8-89eb-26f3c9900c36\"") .contains(" ID=\"s246d157446618e90e43fb79bdd4d9e9e19cf2c7c4\"")