github
/
OpenID-Connect-Java-Spring-Server
mirror of https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

DWN-31929 : move whitelist to class level

pull/1601/head
Harry Smith 2020-02-17 12:51:17 +00:00
parent dd92d8473e
commit acaa64b4d5
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
openid-connect-common/src/main/java/org/mitre/openid/connect/web/UserInfoInterceptor.java
View File

@ -54,6 +54,10 @@ import com.google.gson.JsonSerializer;
*/ */
public class UserInfoInterceptor extends HandlerInterceptorAdapter { public class UserInfoInterceptor extends HandlerInterceptorAdapter {
private final Whitelist whitelist = Whitelist.relaxed()
.removeTags("a")
.removeProtocols("img", "src", "http", "https");
private Gson gson = new GsonBuilder() private Gson gson = new GsonBuilder()
.registerTypeHierarchyAdapter(GrantedAuthority.class, new JsonSerializer<GrantedAuthority>() { .registerTypeHierarchyAdapter(GrantedAuthority.class, new JsonSerializer<GrantedAuthority>() {
@Override @Override
@ -142,10 +146,6 @@ public class UserInfoInterceptor extends HandlerInterceptorAdapter {
} }
private String sanitise(String elementToClean) { private String sanitise(String elementToClean) {
final Whitelist whitelist = Whitelist.relaxed()
.removeTags("a")
.removeProtocols("img", "src", "http", "https");
if (elementToClean != null) { if (elementToClean != null) {
return Jsoup.clean(elementToClean, whitelist); return Jsoup.clean(elementToClean, whitelist);
} }