libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

[KEYCLOAK-11576] - Properly handling redirect_uri parser errors

Browse source
This commit is contained in:
Pedro Igor 2020-02-20 18:46:35 -03:00 committed by Stian Thorgersen
parent 950eae090f
commit 1c71eb93db
2 changed files with 29 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java
View file

@ -84,8 +84,18 @@ public class RedirectUtils {
KeycloakUriInfo uriInfo = session.getContext().getUri();
RealmModel realm = session.getContext().getRealm();
if (redirectUri != null)
redirectUri = normalizeUrl(redirectUri);
if (redirectUri != null) {
try {
URI uri = URI.create(redirectUri);
redirectUri = uri.normalize().toString();
} catch (IllegalArgumentException cause) {
logger.debug("Invalid redirect uri", cause);
return null;
} catch (Exception cause) {
logger.debug("Unexpected error when parsing redirect uri", cause);
return null;
}
}
if (redirectUri == null) {
if (!requireRedirectUri) {
@ -185,13 +195,4 @@ public class RedirectUtils {
}
return validRedirect;
}
private static String normalizeUrl(String url) {
try {
URI uri = new URI(url);
return uri.normalize().toString();
} catch (URISyntaxException e) {
throw new IllegalArgumentException("Invalid URL syntax: " + e.getMessage());
}
}
}

17
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AuthorizationCodeTest.java
View file

@ -114,6 +114,23 @@ public class AuthorizationCodeTest extends AbstractKeycloakTest {
String codeId = events.expectLogin().assertEvent().getDetails().get(Details.CODE_ID);
}
@Test
public void testInvalidRedirectUri() {
ClientManager.realm(adminClient.realm("test")).clientId("test-app").addRedirectUris(oauth.getRedirectUri());
oauth.redirectUri(oauth.getRedirectUri() + "%20test");
oauth.openLoginForm();
assertTrue(errorPage.isCurrent());
assertEquals("Invalid parameter: redirect_uri", errorPage.getError());
oauth.redirectUri("ZAP%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%0A");
oauth.openLoginForm();
assertTrue(errorPage.isCurrent());
assertEquals("Invalid parameter: redirect_uri", errorPage.getError());
}
@Test
public void authorizationRequestNoState() throws IOException {
oauth.stateParamHardcoded(null);