From 2ba7a51da60d31870242a39c887b6dde84b86e6c Mon Sep 17 00:00:00 2001 From: Ricardo Martin Date: Wed, 6 Dec 2023 13:53:01 +0100 Subject: [PATCH] Escape action in the form_post response mode (#60) Closes keycloak/keycloak-private#31 Closes https://issues.redhat.com/browse/RHBK-652 Signed-off-by: rmartinc --- .../saml/BaseSAML2BindingBuilder.java | 2 +- .../oidc/utils/OIDCRedirectUriBuilder.java | 4 ++- .../keycloak/testsuite/util/OAuthClient.java | 3 +++ .../keycloak/testsuite/util/SamlClient.java | 14 ++++++++++ .../oauth/AuthorizationCodeTest.java | 26 +++++++++++++++++++ .../testsuite/saml/BasicSamlTest.java | 25 ++++++++++++++++++ 6 files changed, 72 insertions(+), 2 deletions(-) diff --git a/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java b/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java index 0493e679a24..81c3ee1c7c2 100755 --- a/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java +++ b/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java @@ -381,7 +381,7 @@ public class BaseSAML2BindingBuilder { .append("") .append("") - .append("
"); + .append(""); builder.append("

Redirecting, please wait.

"); diff --git a/services/src/main/java/org/keycloak/protocol/oidc/utils/OIDCRedirectUriBuilder.java b/services/src/main/java/org/keycloak/protocol/oidc/utils/OIDCRedirectUriBuilder.java index 513cb0453aa..e09e4ba789f 100644 --- a/services/src/main/java/org/keycloak/protocol/oidc/utils/OIDCRedirectUriBuilder.java +++ b/services/src/main/java/org/keycloak/protocol/oidc/utils/OIDCRedirectUriBuilder.java @@ -160,7 +160,9 @@ public abstract class OIDCRedirectUriBuilder { builder.append(" "); builder.append(" "); - builder.append(" "); + builder.append(" "); for (Map.Entry param : params.entrySet()) { builder.append(" { + assertThat(response, statusCodeIsHC(Response.Status.OK)); + String responsePage = EntityUtils.toString(response.getEntity(), "UTF-8"); + return SamlClient.extractFormFromPostResponse(responsePage) + .attributes().asList().stream() + .filter(a -> "action".equalsIgnoreCase(a.getKey())) + .map(org.jsoup.nodes.Attribute::getValue) + .findAny().orElse(null); + }); + // if not encoded properly jsoup returns ":" instead of ":" + assertThat(action, endsWith("javascript:alert('xss');")); + } + } }