github
/
OpenID-Connect-Java-Spring-Server
mirror of https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

DWN-37025 : mitigate vulnerability in client logo and unauthorised endpoints

pull/1601/head
Harry Smith 2021-03-25 07:47:25 +00:00
parent 9d99c5140e
commit dd9eb26d43
6 changed files with 13 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
openid-connect-server-webapp/src/main/webapp/WEB-INF/views/approve.jsp
View File

@ -85,7 +85,9 @@
<c:if test="${ not empty client.logoUri }">
<ul class="thumbnails">
<li class="span5">
<a class="thumbnail" data-toggle="modal" data-target="#logoModal"><img src="api/clients/${ client.id }/logo" /></a>
<a class="thumbnail" data-toggle="modal" data-target="#logoModal">
<img src="<c:out value="${ client.logoUri }" />" referrerpolicy="no-referrer" />
</a>
</li>
</ul>
<!-- Modal -->
@ -104,7 +106,7 @@
</h3>
</div>
<div class="modal-body">
<img src="api/clients/${ client.id }/logo" />
<img src="<c:out value="${ client.logoUri }" />" referrerpolicy="no-referrer" />
<c:if test="${ not empty client.clientUri }">
<a href="<c:out value="${ client.clientUri }" />"><c:out value="${ client.clientUri }" /></a>
</c:if>

6
openid-connect-server-webapp/src/main/webapp/WEB-INF/views/approveDevice.jsp
View File

@ -85,7 +85,9 @@
<c:if test="${ not empty client.logoUri }">
<ul class="thumbnails">
<li class="span5">
<a class="thumbnail" data-toggle="modal" data-target="#logoModal"><img src="api/clients/${ client.id }/logo" /></a>
<a class="thumbnail" data-toggle="modal" data-target="#logoModal">
<img src="<c:out value="${ client.logoUri }" />" referrerpolicy="no-referrer" />
</a>
</li>
</ul>
<!-- Modal -->
@ -104,7 +106,7 @@
</h3>
</div>
<div class="modal-body">
<img src="api/clients/${ client.id }/logo" />
<img src="<c:out value="${ client.logoUri }" />" referrerpolicy="no-referrer" />
<c:if test="${ not empty client.clientUri }">
<a href="<c:out value="${ client.clientUri }" />"><c:out value="${ client.clientUri }" /></a>
</c:if>

4
openid-connect-server-webapp/src/main/webapp/resources/template/client.html
View File

@ -26,7 +26,9 @@
<div class="media">
<% if (client.logoUri) { %>
<span class="pull-left"><img class="media-object client-logo" src="api/clients/<%- client.id %>/logo"></span>
<span class="pull-left">
<img class="media-object client-logo" src="<%- client.logoUri %>" referrerpolicy="no-referrer" />
</span>
<% } %>
<div class="media-body">

28
openid-connect-server/src/main/java/org/mitre/openid/connect/web/ClientAPI.java
View File

@ -133,9 +133,6 @@ public class ClientAPI {
@Autowired
private ClientDetailsEntityService clientService;
@Autowired
private ClientLogoLoadingService clientLogoLoadingService;
@Autowired
@Qualifier("clientAssertionValidator")
private AssertionValidator assertionValidator;
@ -519,31 +516,6 @@ public class ClientAPI {
}
}
/**
* Get the logo image for a client
* @param id
*/
@RequestMapping(value = "/{id}/logo", method=RequestMethod.GET, produces = { MediaType.IMAGE_GIF_VALUE, MediaType.IMAGE_JPEG_VALUE, MediaType.IMAGE_PNG_VALUE })
public ResponseEntity<byte[]> getClientLogo(@PathVariable("id") Long id, Model model) {
ClientDetailsEntity client = clientService.getClientById(id);
if (client == null) {
return new ResponseEntity<>(HttpStatus.NOT_FOUND);
} else if (Strings.isNullOrEmpty(client.getLogoUri())) {
return new ResponseEntity<>(HttpStatus.NOT_FOUND);
} else {
// get the image from cache
CachedImage image = clientLogoLoadingService.getLogo(client);
HttpHeaders headers = new HttpHeaders();
headers.setContentType(MediaType.parseMediaType(image.getContentType()));
headers.setContentLength(image.getLength());
return new ResponseEntity<>(image.getData(), headers, HttpStatus.OK);
}
}
private ClientDetailsEntity validateSoftwareStatement(ClientDetailsEntity newClient) throws ValidationException {
if (newClient.getSoftwareStatement() != null) {
if (assertionValidator.isValid(newClient.getSoftwareStatement())) {

1
openid-connect-server/src/main/java/org/mitre/openid/connect/web/DynamicClientRegistrationEndpoint.java
View File

@ -150,6 +150,7 @@ public class DynamicClientRegistrationEndpoint {
* @param p
* @return
*/
@PreAuthorize("hasRole('ROLE_USER')")
@RequestMapping(method = RequestMethod.POST, consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
public String registerNewClient(@RequestBody String jsonString, Model m) {

1
openid-connect-server/src/main/java/org/mitre/openid/connect/web/ProtectedResourceRegistrationEndpoint.java
View File

@ -91,6 +91,7 @@ public class ProtectedResourceRegistrationEndpoint {
* @param p
* @return
*/
@PreAuthorize("hasRole('ROLE_USER')")
@RequestMapping(method = RequestMethod.POST, consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
public String registerNewProtectedResource(@RequestBody String jsonString, Model m) {