Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1753: Cater for missing DiscoveryInformation object in OpenID4JavaConsumer.endConsumption.

This commit is contained in:
Luke Taylor 2011-07-13 22:29:47 +01:00
parent 700fa9e0b6
commit 89fa771093
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
openid/src/main/java/org/springframework/security/openid/OpenID4JavaConsumer.java
View File

@ -144,6 +144,11 @@ public class OpenID4JavaConsumer implements OpenIDConsumer {
// retrieve the previously stored discovery information
DiscoveryInformation discovered = (DiscoveryInformation) request.getSession().getAttribute(DISCOVERY_INFO_KEY);
if (discovered == null) {
throw new OpenIDConsumerException("DiscoveryInformation is not available. Possible causes are lost session or replay attack");
}
List<OpenIDAttribute> attributesToFetch = (List<OpenIDAttribute>) request.getSession().getAttribute(ATTRIBUTE_LIST_KEY);
request.getSession().removeAttribute(DISCOVERY_INFO_KEY);

5
openid/src/test/java/org/springframework/security/openid/OpenID4JavaConsumerTests.java
View File

@ -189,6 +189,11 @@ public class OpenID4JavaConsumerTests {
consumer.fetchAxAttributes(msg, attributes);
}
@Test(expected=OpenIDConsumerException.class)
public void missingDiscoveryInformationThrowsException() throws Exception {
OpenID4JavaConsumer consumer = new OpenID4JavaConsumer(new NullAxFetchListFactory());
consumer.endConsumption(new MockHttpServletRequest());
}
@SuppressWarnings("deprecation")
@Test