libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

[KEYCLOAK-14352] JavaScript injection vulnerability of Realm registration REST API

Browse source
This commit is contained in:
Douglas Palmer 2020-06-16 10:57:00 -07:00 committed by Bruno Oliveira da Silva
parent ab347df5ee
commit 43e075afa5
2 changed files with 51 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
services/src/main/java/org/keycloak/services/managers/RealmManager.java
View file

@ -96,7 +96,12 @@ public class RealmManager {
} }
public RealmModel createRealm(String id, String name) { public RealmModel createRealm(String id, String name) {
if (id == null) id = KeycloakModelUtils.generateId(); if (id == null) {
id = KeycloakModelUtils.generateId();
}
else {
ReservedCharValidator.validate(id);
}
ReservedCharValidator.validate(name); ReservedCharValidator.validate(name);
RealmModel realm = model.createRealm(id, name); RealmModel realm = model.createRealm(id, name);
realm.setName(name); realm.setName(name);
@ -502,6 +507,9 @@ public class RealmManager {
if (id == null) { if (id == null) {
id = KeycloakModelUtils.generateId(); id = KeycloakModelUtils.generateId();
} }
else {
ReservedCharValidator.validate(id);
}
RealmModel realm = model.createRealm(id, rep.getRealm()); RealmModel realm = model.createRealm(id, rep.getRealm());
ReservedCharValidator.validate(rep.getRealm()); ReservedCharValidator.validate(rep.getRealm());
realm.setName(rep.getRealm()); realm.setName(rep.getRealm());

42
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/BadRealmTest.java Normal file
View file

@ -0,0 +1,42 @@
package org.keycloak.testsuite.model;
import org.junit.Test;
import org.keycloak.models.KeycloakSession;
import org.keycloak.representations.idm.RealmRepresentation;
import org.keycloak.services.managers.RealmManager;
import org.keycloak.testsuite.AbstractKeycloakTest;
import org.keycloak.testsuite.arquillian.annotation.ModelTest;
import org.keycloak.utils.ReservedCharValidator;
import java.util.List;
import static org.junit.Assert.fail;
public class BadRealmTest extends AbstractKeycloakTest {
private String name = "MyRealm";
private String id = "MyId";
private String script = "<script>alert(4)</script>";
public void addTestRealms(List<RealmRepresentation> testRealms) {
}
@Test
@ModelTest
public void testBadRealmName(KeycloakSession session) {
RealmManager manager = new RealmManager(session);
try {
manager.createRealm(id, name + script);
fail();
} catch (ReservedCharValidator.ReservedCharException ex) {}
}
@Test
@ModelTest
public void testBadRealmId(KeycloakSession session) {
RealmManager manager = new RealmManager(session);
try {
manager.createRealm(id + script, name);
fail();
} catch (ReservedCharValidator.ReservedCharException ex) {}
}
}