[
https://issues.apache.org/jira/browse/KNOX-3551?focusedWorklogId=1052674&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1052674
]
ASF GitHub Bot logged work on KNOX-3551:
----------------------------------------
Author: ASF GitHub Bot
Created on: 05/Nov/26 09:51
Start Date: 05/Nov/26 09:51
Worklog Time Spent: 10m
Work Description: smolnar82 merged PR #1490:
URL: https://github.com/apache/knox/pull/1490
Issue Time Tracking
-------------------
Worklog Id: (was: 1052674)
Time Spent: 20m (was: 10m)
> KnoxIDF: accepting consent fails with an NPE because the consent state form
> field is lost
> -----------------------------------------------------------------------------------------
>
> Key: KNOX-3551
> URL: https://issues.apache.org/jira/browse/KNOX-3551
> Project: Apache Knox
> Issue Type: Improvement
> Components: KnoxIDF
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> In the KnoxIDF authorization code flow, clicking *Accept* on the consent page
> returns HTTP 500:
> {code}
> java.lang.NullPointerException: Cannot invoke "Object.hashCode()" because
> "key" is null
> at com.github.benmanes.caffeine.cache.LocalManualCache.getIfPresent(...)
> at
> org.apache.knox.gateway.util.knoxidf.KnoxIDFArtifactStore.get(KnoxIDFArtifactStore.java:41)
> at
> org.apache.knox.gateway.service.knoxidf.AuthorizeResource.consentAccepted(AuthorizeResource.java:405)
> {code}
> {{AuthConsentServlet}} sends the consent {{state}} as a hidden field in a
> form POST ({{application/x-www-form-urlencoded}}).
> {{AuthorizeResource.consentAccepted()}} reads it with
> {{request.getParameter("state")}}. When the topology uses an
> identity-assertion provider (e.g. {{Default}}), the request is wrapped by
> {{IdentityAsserterHttpServletRequestWrapper}}. That wrapper reads and
> re-encodes form bodies in {{getInputStream()}}, and once the body has been
> read the container stops exposing form fields as servlet parameters. So
> {{state}} comes back {{null}}, even from the unwrapped request. The {{null}}
> then goes to the Caffeine-backed state store, which throws on null keys.
> *Steps to reproduce:*
> # Use a KnoxIDF SSO topology with an identity-assertion provider and
> {{knoxidf.auto.consent.enabled=false}}.
> # Start the flow at
> {{/knoxidf/api/v1/authorize?response_type=code&client_id=...&state=...&scope=openid&redirect_uri=...}}.
> # Click *Accept* on the consent page. The response is a 500 with the NPE
> above.
> *Recommended fix:*
> * Bind {{state}} in {{consentAccepted}} with JAX-RS {{@FormParam}} instead of
> {{request.getParameter()}}.
> * Return a 400 {{invalid_request}} when {{state}} is missing or blank.
> * Make {{KnoxIDFArtifactStore.get()}} and {{remove()}} treat a null key as a
> miss.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
