github
/
OpenID-Connect-Java-Spring-Server
mirror of https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix XSS (CVE-2020-5497)

pull/1534/head
Aaron Bishop 2020-04-10 15:15:49 -06:00
parent 0d4ef2cb4f
commit cacf6a653b
No known key found for this signature in database
GPG Key ID: 1B861680E201203F
2 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
openid-connect-common/src/main/java/org/mitre/openid/connect/web/UserInfoInterceptor.java
View File

@ -79,8 +79,9 @@ public class UserInfoInterceptor extends HandlerInterceptorAdapter {
// if they're logging into this server from a remote OIDC server, pass through their user info // if they're logging into this server from a remote OIDC server, pass through their user info
OIDCAuthenticationToken oidc = (OIDCAuthenticationToken) auth; OIDCAuthenticationToken oidc = (OIDCAuthenticationToken) auth;
if (oidc.getUserInfo() != null) { if (oidc.getUserInfo() != null) {
JsonElement json = gson.fromJson(oidc.getUserInfo().toJson().toString(), JsonElement.class);
request.setAttribute("userInfo", oidc.getUserInfo()); request.setAttribute("userInfo", oidc.getUserInfo());
request.setAttribute("userInfoJson", oidc.getUserInfo().toJson()); request.setAttribute("userInfoJson", gson.toJson(json));
} else { } else {
request.setAttribute("userInfo", null); request.setAttribute("userInfo", null);
request.setAttribute("userInfoJson", "null"); request.setAttribute("userInfoJson", "null");
@ -94,8 +95,9 @@ public class UserInfoInterceptor extends HandlerInterceptorAdapter {
// if we have one, inject it so views can use it // if we have one, inject it so views can use it
if (user != null) { if (user != null) {
JsonElement json = gson.fromJson(user.toJson().toString(), JsonElement.class);
request.setAttribute("userInfo", user); request.setAttribute("userInfo", user);
request.setAttribute("userInfoJson", user.toJson()); request.setAttribute("userInfoJson", gson.toJson(json));
} }
} }
} }

9
openid-connect-server-webapp/src/main/webapp/WEB-INF/tags/topbar.tag
View File

@ -1,24 +1,25 @@
<%@attribute name="pageName" required="false"%> <%@attribute name="pageName" required="false"%>
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%> <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions"%>
<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags"%> <%@ taglib prefix="security" uri="http://www.springframework.org/security/tags"%>
<%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%> <%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>
<%@ taglib prefix="o" tagdir="/WEB-INF/tags"%> <%@ taglib prefix="o" tagdir="/WEB-INF/tags"%>
<c:choose> <c:choose>
<c:when test="${ not empty userInfo.preferredUsername }"> <c:when test="${ not empty userInfo.preferredUsername }">
<c:set var="shortName" value="${ userInfo.preferredUsername }" /> <c:set var="shortName" value="${ fn:escapeXml(userInfo.preferredUsername) }" />
</c:when> </c:when>
<c:otherwise> <c:otherwise>
<c:set var="shortName" value="${ userInfo.sub }" /> <c:set var="shortName" value="${ fn:escapeXml(userInfo.sub) }" />
</c:otherwise> </c:otherwise>
</c:choose> </c:choose>
<c:choose> <c:choose>
<c:when test="${ not empty userInfo.name }"> <c:when test="${ not empty userInfo.name }">
<c:set var="longName" value="${ userInfo.name }" /> <c:set var="longName" value="${ fn:escapeXml(userInfo.name) }" />
</c:when> </c:when>
<c:otherwise> <c:otherwise>
<c:choose> <c:choose>
<c:when test="${ not empty userInfo.givenName || not empty userInfo.familyName }"> <c:when test="${ not empty userInfo.givenName || not empty userInfo.familyName }">
<c:set var="longName" value="${ userInfo.givenName } ${ userInfo.familyName }" /> <c:set var="longName" value="${ fn:escapeXml(userInfo.givenName) } ${ fn:escapeXml(userInfo.familyName) }" />
</c:when> </c:when>
<c:otherwise> <c:otherwise>
<c:set var="longName" value="${ shortName }" /> <c:set var="longName" value="${ shortName }" />