aboutsummaryrefslogtreecommitdiff
path: root/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
diff options
context:
space:
mode:
Diffstat (limited to 'id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java')
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java159
1 files changed, 93 insertions, 66 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
index a44d8c1b6..0e468bb6b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
@@ -49,6 +49,7 @@ package at.gv.egovernment.moa.id.util;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.net.MalformedURLException;
+import java.net.URISyntaxException;
import java.net.URL;
import java.util.Collections;
import java.util.HashMap;
@@ -63,6 +64,7 @@ import javax.xml.parsers.ParserConfigurationException;
import org.xml.sax.SAXException;
import at.gv.egiz.eaaf.core.impl.utils.DOMUtils;
+import at.gv.egiz.eaaf.core.impl.utils.FileUtils;
import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
@@ -220,11 +222,11 @@ public class ParamValidatorUtils extends MOAIDAuthConstants{
}
// check if template is a valid URL
- try {
+ try {
+ URL bkuUrl = new URL(bkuURI);
// check if bku url starts with http or https
- if (bkuURI.startsWith("http") || bkuURI.startsWith("https")) {
- new URL(bkuURI);
-
+ if (bkuUrl.getProtocol().equals("http") || bkuUrl.getProtocol().equals("https")) {
+
// check if bkuURI is a local BKU
if (bkuURI.compareToIgnoreCase("https://localhost:3496/https-security-layer-request") == 0 ||
bkuURI.compareToIgnoreCase("http://localhost:3495/http-security-layer-request") == 0 ||
@@ -232,8 +234,8 @@ public class ParamValidatorUtils extends MOAIDAuthConstants{
bkuURI.compareToIgnoreCase("https://127.0.0.1:3496/https-security-layer-request") == 0) {
Logger.debug("Parameter bkuURI erfolgreich ueberprueft");
return true;
- }
- else {
+
+ } else {
Logger.debug("Parameter bkuURI ist keine lokale BKU. Ueberpruefe Liste der vertrauenswuerdigen BKUs.");
boolean b = allowedBKUs.contains(bkuURI);
if (b) {
@@ -246,17 +248,17 @@ public class ParamValidatorUtils extends MOAIDAuthConstants{
return false;
}
}
- }
- else if (MOAIDAuthConstants.REQ_BKU_TYPES.contains(bkuURI)) {
+
+ } else if (MOAIDAuthConstants.REQ_BKU_TYPES.contains(bkuURI)) {
Logger.debug("Parameter bkuURI from configuration is used.");
return true;
} else {
Logger.error("Fehler Ueberpruefung Parameter bkuURI. bkuURI beginnt nicht mit http or https");
return false;
+
}
-
} catch (MalformedURLException e) {
Logger.error("Fehler Ueberpruefung Parameter bkuURI", e);
return false;
@@ -268,9 +270,12 @@ public class ParamValidatorUtils extends MOAIDAuthConstants{
* Checks if the given template is valid
* @param req
* @param template
+ * @param oaSlTemplates
+ * @param useStrictValidation Enables strict validation with URLs from configuration, otherwise always allow templates from same host.
* @return
*/
- public static boolean isValidTemplate(HttpServletRequest req, String template, List<String> oaSlTemplates) {
+ public static boolean isValidTemplate(HttpServletRequest req, String template,
+ List<String> oaSlTemplates, boolean useStrictValidation) {
Logger.debug("Ueberpruefe Parameter Template bzw. bkuSelectionTemplateURL");
@@ -282,65 +287,38 @@ public class ParamValidatorUtils extends MOAIDAuthConstants{
// check if template is a valid URL
try {
-
- // check if template url starts with http or https
- if (template.startsWith("http") || template.startsWith("https")) {
-
- // check if template url is from same server
- String name = req.getServerName();
- String httpName = "http://" + name;
- String httpsName = "https://" + name;
-
- if (template.startsWith(httpName) || template.startsWith(httpsName)) {
- new URL(template);
- Logger.debug("Parameter Template bzw. bkuSelectionTemplateURL erfolgreich ueberprueft");
- return true;
- }
- else {
- //check against configured trustet template urls
- AuthConfiguration authConf = AuthConfigurationProviderFactory.getInstance();
- List<String> trustedTemplateURLs = authConf.getSLRequestTemplates();
-
- //get OA specific template URLs
- if (oaSlTemplates != null && oaSlTemplates.size() > 0) {
- for (String el : oaSlTemplates)
- if (MiscUtil.isNotEmpty(el))
- trustedTemplateURLs.add(el);
- }
-
- boolean b = trustedTemplateURLs.contains(template);
- if (b) {
- Logger.debug("Parameter Template erfolgreich ueberprueft");
- return true;
- }
- else {
- Logger.error("Fehler Ueberpruefung Parameter Template bzw. bkuSelectionTemplateURL. Parameter liegt nicht am gleichen Server wie die MOA-Instanz (" + req.getServerName() + ") bzw. ist nicht auf Liste der vertrauenswuerdigen Template URLs (Konfigurationselement: MOA-IDConfiguration/TrustedTemplateURLs)");
- return false;
- }
-
- }
-
- } else if (template.startsWith("file")){
- new URL(template);
- Logger.debug("Parameter Template bzw. bkuSelectionTemplateURL erfolgreich ueberprueft");
- Logger.debug("Load SL-Layer Template from local filesystem " + template);
- return true;
-
- } else {
- Logger.error("Fehler Ueberpruefung Parameter Template bzw. bkuSelectionTemplateURL. Paramter beginnt nicht mit http oder https.");
- return false;
- }
+ if (useStrictValidation) {
+ Logger.trace("Use strict validation of Template bzw. bkuSelectionTemplateURL");
+ return validateTemplateUrlToWhiteList(template, oaSlTemplates);
+
+ } else {
+ Logger.trace("Use lazy validation of Template bzw. bkuSelectionTemplateURL");
+ URL templateUrl = new URL(template);
+ String serverName = req.getServerName();
+
+ // check if template url starts with http or https
+ if (((templateUrl.getProtocol().startsWith("http")
+ || templateUrl.getProtocol().startsWith("https")))
+ && templateUrl.getHost().equals(serverName)) {
+ Logger.debug("Parameter Template bzw. bkuSelectionTemplateURL erfolgreich ueberprueft"
+ + " Lazy check is activ and template is on same host as MOA-ID");
+ return true;
+
+
+ } else {
+ return validateTemplateUrlToWhiteList(template, oaSlTemplates);
+
+ }
+ }
- } catch (MalformedURLException e) {
+ } catch (MalformedURLException | ConfigurationException | URISyntaxException e) {
Logger.error("Fehler Ueberpruefung Parameter Template bzw. bkuSelectionTemplateURL.", e);
return false;
- } catch (ConfigurationException e) {
- Logger.error("Fehler Ueberpruefung Parameter Template bzw. bkuSelectionTemplateURL.", e);
- return false;
- }
+
+ }
}
- /**
+ /**
* Checks if the given sessionID is valid
* @param target HTTP parameter from request
* @return
@@ -540,13 +518,62 @@ public class ParamValidatorUtils extends MOAIDAuthConstants{
} catch (WrongParametersException e) {
return false;
+
}
- if (StringUtils.isEmpty(bkuURL) && StringUtils.isEmpty(useeIDAS))
+ if (StringUtils.isEmpty(bkuURL) && StringUtils.isEmpty(useeIDAS)) {
return false;
- else
+
+ } else {
return true;
+
+ }
}
+
+ private static boolean validateTemplateUrlToWhiteList(String template, List<String> oaSlTemplates)
+ throws ConfigurationException, MalformedURLException, URISyntaxException {
+ //check against configured trustet template urls
+ AuthConfiguration authConf = AuthConfigurationProviderFactory.getInstance();
+ List<String> trustedTemplateURLs = authConf.getSLRequestTemplates();
+
+ //get OA specific template URLs
+ if (oaSlTemplates != null && !oaSlTemplates.isEmpty()) {
+ for (String el : oaSlTemplates)
+ if (MiscUtil.isNotEmpty(el))
+ trustedTemplateURLs.add(el);
+ }
+
+ boolean b = false;
+ if (template.startsWith("file:")) {
+ for (String el : trustedTemplateURLs) {
+ URL templateUrl = new URL(template);
+ URL trustedUrl = new URL(FileUtils.makeAbsoluteURL(el, authConf.getConfigurationRootDirectory()));
+ b = trustedUrl.equals(templateUrl);
+ if (b) {
+ break;
+ }
+ }
+
+ } else {
+ b = trustedTemplateURLs.contains(template);
+
+ }
+
+
+ if (b) {
+ Logger.debug("Parameter Template erfolgreich ueberprueft");
+ return true;
+
+ } else {
+ Logger.info("Template:" + template + " DOES NOT match to allowed templates: ["
+ + org.apache.commons.lang3.StringUtils.join(trustedTemplateURLs, ",") + "]");
+ Logger.error("Fehler Ueberpruefung Parameter Template bzw. bkuSelectionTemplateURL. "
+ + "Parameter ist nicht auf Liste der vertrauenswuerdigen Template URLs "
+ + "(Konfigurationselement: MOA-IDConfiguration/TrustedTemplateURLs)");
+ return false;
+
+ }
+ }
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-15 20:03:49 +0000