From c7f57bf447d5ec6883ce53d64559ae50462dd570 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Wed, 25 Jul 2018 13:03:27 +0200 Subject: fix bug in auth/AbstractAuthenticationManager.java which adds http header names without toLowerCase() --- .../idp/auth/AbstractAuthenticationManager.java | 11 ++++++++--- .../gv/egiz/eaaf/core/impl/utils/ArrayUtils.java | 22 ++++++++++++++++++++++ 2 files changed, 30 insertions(+), 3 deletions(-) create mode 100644 eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/ArrayUtils.java (limited to 'eaaf_core/src') diff --git a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/AbstractAuthenticationManager.java b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/AbstractAuthenticationManager.java index 1fb4bf6b..afadeb61 100644 --- a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/AbstractAuthenticationManager.java +++ b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/AbstractAuthenticationManager.java @@ -256,12 +256,17 @@ public abstract class AbstractAuthenticationManager implements IAuthenticationMa Enumeration reqHeaderNames = httpReq.getHeaderNames(); while(reqHeaderNames.hasMoreElements()) { String paramName = reqHeaderNames.nextElement(); - if (StringUtils.isNotEmpty(paramName) && reqHeaderWhiteListeForModules.contains(paramName.toLowerCase()) ) - executionContext.put(paramName, StringEscapeUtils.escapeHtml4(httpReq.getHeader(paramName))); + if (StringUtils.isNotEmpty(paramName) + && at.gv.egiz.eaaf.core.impl.utils.ArrayUtils.containsCaseInsensitive(paramName, reqHeaderWhiteListeForModules) + //reqHeaderWhiteListeForModules.contains(paramName.toLowerCase()) + ) + executionContext.put(paramName.toLowerCase(), StringEscapeUtils.escapeHtml4(httpReq.getHeader(paramName))); } } + + //populate more IDP specific information to execution context populateExecutionContext(executionContext, pendingReq, httpReq); @@ -269,7 +274,7 @@ public abstract class AbstractAuthenticationManager implements IAuthenticationMa startProcessEngine(pendingReq, executionContext); } - + /** * * diff --git a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/ArrayUtils.java b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/ArrayUtils.java new file mode 100644 index 00000000..f399ee75 --- /dev/null +++ b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/ArrayUtils.java @@ -0,0 +1,22 @@ +package at.gv.egiz.eaaf.core.impl.utils; + +import java.util.List; + +public class ArrayUtils { + + /** + * Check if a String 's' is part of a List 'l' in qualsIgnoreCase mode + * + * @param s Search String + * @param l List of String elements + * @return true if 's' is in 'l', otherwise false + */ + public static boolean containsCaseInsensitive(String s, List l){ + if (l == null || s == null) + return false; + + return l.stream().anyMatch(x -> x.equalsIgnoreCase(s)); + + } + +} -- cgit v1.2.3