github
/
OpenID-Connect-Java-Spring-Server
mirror of https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

added in checks to blacklist service upon client registration and update

pull/263/head
Justin Richer 2012-11-19 14:10:55 -05:00
parent 7a6c96a759
commit 5b0c17c5de
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/DefaultOAuth2ClientDetailsEntityService.java
View File

@ -68,9 +68,15 @@ public class DefaultOAuth2ClientDetailsEntityService implements ClientDetailsEnt
@Override @Override
public ClientDetailsEntity saveNewClient(ClientDetailsEntity client) { public ClientDetailsEntity saveNewClient(ClientDetailsEntity client) {
if (client.getId() != null) { // if it's not null, it's already been saved, this is an error if (client.getId() != null) { // if it's not null, it's already been saved, this is an error
return null; // TODO: throw exception? throw new IllegalArgumentException("Tried to save a new client with an existing ID: " + client.getId());
} }
for (String uri : client.getRegisteredRedirectUri()) {
if (blacklistedSiteService.isBlacklisted(uri)) {
throw new IllegalArgumentException("Client URI is blacklisted: " + uri);
}
}
// assign a random clientid if it's empty // assign a random clientid if it's empty
// NOTE: don't assign a random client secret without asking, since public clients have no secret // NOTE: don't assign a random client secret without asking, since public clients have no secret
if (Strings.isNullOrEmpty(client.getClientId())) { if (Strings.isNullOrEmpty(client.getClientId())) {
@ -141,6 +147,13 @@ public class DefaultOAuth2ClientDetailsEntityService implements ClientDetailsEnt
@Override @Override
public ClientDetailsEntity updateClient(ClientDetailsEntity oldClient, ClientDetailsEntity newClient) throws IllegalArgumentException { public ClientDetailsEntity updateClient(ClientDetailsEntity oldClient, ClientDetailsEntity newClient) throws IllegalArgumentException {
if (oldClient != null && newClient != null) { if (oldClient != null && newClient != null) {
for (String uri : newClient.getRegisteredRedirectUri()) {
if (blacklistedSiteService.isBlacklisted(uri)) {
throw new IllegalArgumentException("Client URI is blacklisted: " + uri);
}
}
return clientRepository.updateClient(oldClient.getId(), newClient); return clientRepository.updateClient(oldClient.getId(), newClient);
} }
throw new IllegalArgumentException("Neither old client or new client can be null!"); throw new IllegalArgumentException("Neither old client or new client can be null!");