libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

[KEYCLOAK-17602] Email account verification link is wrongly encoded

Browse source
This commit is contained in:
Douglas Palmer 2021-05-31 21:18:50 -07:00 committed by Stian Thorgersen
parent b152d89e22
commit aac0b6ec5f
2 changed files with 19 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
services/src/main/java/org/keycloak/theme/KeycloakSanitizerMethod.java
View file

@ -21,6 +21,9 @@ import freemarker.template.TemplateMethodModelEx;
import freemarker.template.TemplateModelException; import freemarker.template.TemplateModelException;
import java.util.List; import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import org.owasp.html.PolicyFactory; import org.owasp.html.PolicyFactory;
/** /**
@ -41,7 +44,22 @@ public class KeycloakSanitizerMethod implements TemplateMethodModelEx {
String html = list.get(0).toString(); String html = list.get(0).toString();
String sanitized = KEYCLOAK_POLICY.sanitize(html); String sanitized = KEYCLOAK_POLICY.sanitize(html);
return sanitized; return fixURLs(sanitized);
}
private String fixURLs(String msg) {
Pattern hrefs = Pattern.compile("href=\"([^\"]*)\"");
Matcher matcher = hrefs.matcher(msg);
int count = 0;
while(matcher.find()) {
count++;
String original = matcher.group(count);
String href = original.replaceAll("=", "=")
.replaceAll("\\.\\.", ".")
.replaceAll("&", "&");
msg = msg.replace(original, href);
}
return msg;
} }
} }

5
testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/MailUtils.java
View file

@ -61,11 +61,6 @@ public class MailUtils {
final String textChangePwdUrl = getLink(body.getText()); final String textChangePwdUrl = getLink(body.getText());
String htmlChangePwdUrl = getLink(body.getHtml()); String htmlChangePwdUrl = getLink(body.getHtml());
// undo changes that may have been made by html sanitizer
htmlChangePwdUrl = htmlChangePwdUrl.replace("=", "=");
htmlChangePwdUrl = htmlChangePwdUrl.replace("..", ".");
htmlChangePwdUrl = htmlChangePwdUrl.replace("&", "&");
assertEquals(htmlChangePwdUrl, textChangePwdUrl); assertEquals(htmlChangePwdUrl, textChangePwdUrl);
return htmlChangePwdUrl; return htmlChangePwdUrl;