rootvector2 commented on PR #3654: URL: https://github.com/apache/cxf/pull/3654#issuecomment-6539634579
All five are in. `setAllowedRelayStateOrigins(List<String>)` defaults to empty and matches entries on parsed scheme, host and port, so `https://[email protected]/` and `https://app.example.com.evil.example.com/` don't get through. The check is now `protected URI getRelayStateLocation(String, URI)`, so a subclass can override just that. I normalized default ports rather than documenting them, so `https://sp.example.com:443/app` now matches. An ignored RelayState logs a warning with control characters replaced, since the value is untrusted. The condition has its parentheses, and the tests cover `//evil.example.com/` plus allowed and lookalike origins. One side effect: comparing parsed hosts means a host `java.net.URI` can't parse, like `my_service`, has a null `getHost()`. A service on such a host now ignores an absolute same-origin RelayState and logs it, and the allowlist can't match it either. Relative values still redirect. It fails safe and it's noted in the method comment. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
