libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

Fix saml-core issues without changing Java version

Browse source
This commit is contained in:
stianst 2021-09-27 16:25:40 +02:00 committed by Stian Thorgersen
parent 8b262e3094
commit b04236f7de
4 changed files with 23 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
saml-core/pom.xml
View file

@ -31,8 +31,8 @@
<description/> <description/>
<properties> <properties>
<maven.compiler.target>1.8</maven.compiler.target> <maven.compiler.target>1.7</maven.compiler.target>
<maven.compiler.source>1.8</maven.compiler.source> <maven.compiler.source>1.7</maven.compiler.source>
<timestamp>${maven.build.timestamp}</timestamp> <timestamp>${maven.build.timestamp}</timestamp>
<skip.security-manager.tests>true</skip.security-manager.tests> <skip.security-manager.tests>true</skip.security-manager.tests>

5
saml-core/src/main/java/org/keycloak/saml/common/util/TransformerUtil.java
View file

@ -23,6 +23,7 @@ import org.keycloak.saml.common.constants.GeneralConstants;
import org.keycloak.saml.common.exceptions.ConfigurationException; import org.keycloak.saml.common.exceptions.ConfigurationException;
import org.keycloak.saml.common.exceptions.ParsingException; import org.keycloak.saml.common.exceptions.ParsingException;
import org.keycloak.saml.common.exceptions.ProcessingException; import org.keycloak.saml.common.exceptions.ProcessingException;
import org.keycloak.saml.processing.core.util.FixXMLConstants;
import org.w3c.dom.Document; import org.w3c.dom.Document;
import org.w3c.dom.Element; import org.w3c.dom.Element;
import org.w3c.dom.Node; import org.w3c.dom.Node;
@ -116,9 +117,9 @@ public class TransformerUtil {
logger.warn("XML External Entity switches are not supported. You may get XML injection vulnerabilities."); logger.warn("XML External Entity switches are not supported. You may get XML injection vulnerabilities.");
} }
try { try {
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); transformerFactory.setAttribute(FixXMLConstants.ACCESS_EXTERNAL_DTD, "");
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); transformerFactory.setAttribute(FixXMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
} catch (Exception ignored) { } catch (Exception ignored) {
// some platforms don't support this. For example our testsuite pulls Selenium which requires Xalan 2.7.1 // some platforms don't support this. For example our testsuite pulls Selenium which requires Xalan 2.7.1
logger.warn("XML External Entity switches are not supported. You may get XML injection vulnerabilities."); logger.warn("XML External Entity switches are not supported. You may get XML injection vulnerabilities.");

16
saml-core/src/main/java/org/keycloak/saml/processing/core/util/FixXMLConstants.java Normal file
View file

@ -0,0 +1,16 @@
package org.keycloak.saml.processing.core.util;
/**
* Constants copied from XMLConstants to work around issues with IntelliJ
*
* See https://issues.redhat.com/browse/KEYCLOAK-19403
*/
public class FixXMLConstants {
public static final String ACCESS_EXTERNAL_DTD = "http://javax.xml.XMLConstants/property/accessExternalDTD";
public static final String ACCESS_EXTERNAL_SCHEMA = "http://javax.xml.XMLConstants/property/accessExternalSchema";
public static final String ACCESS_EXTERNAL_STYLESHEET = "http://javax.xml.XMLConstants/property/accessExternalStylesheet";
}

4
saml-core/src/main/java/org/keycloak/saml/processing/core/util/JAXPValidationUtil.java
View file

@ -98,8 +98,8 @@ public class JAXPValidationUtil {
// Do not optimize the following into setProperty(...) && setProperty(...). // Do not optimize the following into setProperty(...) && setProperty(...).
// This way if it fails in the first setProperty, it will try the subsequent setProperty anyway // This way if it fails in the first setProperty, it will try the subsequent setProperty anyway
// which it would not due to short-circuiting in case of an && expression. // which it would not due to short-circuiting in case of an && expression.
boolean successful1 = setProperty(validator, XMLConstants.ACCESS_EXTERNAL_DTD, ""); boolean successful1 = setProperty(validator, FixXMLConstants.ACCESS_EXTERNAL_DTD, "");
successful1 &= setProperty(validator, XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); successful1 &= setProperty(validator, FixXMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
boolean successful2 = setFeature(validator, feature_disallow_doctype_decl, true); boolean successful2 = setFeature(validator, feature_disallow_doctype_decl, true);
successful2 &= setFeature(validator, feature_external_general_entities, false); successful2 &= setFeature(validator, feature_external_general_entities, false);
successful2 &= setFeature(validator, feature_external_parameter_entities, false); successful2 &= setFeature(validator, feature_external_parameter_entities, false);