Skip to content

Commit da94fbe

Browse files
jonah1und1sjohnr
jonah1und1
authored and
sjohnr
committed
Evaluate URI query parameter only if enabled
Issue gh-16038
1 parent 857ef6f commit da94fbe

6 files changed

Lines changed: 62 additions & 25 deletions

File tree

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurerTests.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1560,12 +1560,15 @@ static class JwkSetUriConfig {
15601560
@Bean
15611561
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
15621562
// @formatter:off
1563+
DefaultBearerTokenResolver defaultBearerTokenResolver = new DefaultBearerTokenResolver();
1564+
defaultBearerTokenResolver.setAllowUriQueryParameter(true);
15631565
http
15641566
.authorizeRequests()
15651567
.requestMatchers("/requires-read-scope").access("hasAuthority('SCOPE_message:read')")
15661568
.anyRequest().authenticated()
15671569
.and()
15681570
.oauth2ResourceServer()
1571+
.bearerTokenResolver(defaultBearerTokenResolver)
15691572
.jwt()
15701573
.jwkSetUri(this.jwkSetUri);
15711574
return http.build();

‎config/src/test/resources/org/springframework/security/config/http/OAuth2ResourceServerBeanDefinitionParserTests-JwkSetUri.xml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,15 @@
2525

2626
<c:property-placeholder local-override="true"/>
2727

28+
<b:bean id="bearerTokenResolver"
29+
class="org.springframework.security.oauth2.server.resource.web.DefaultBearerTokenResolver">
30+
<b:property name="allowUriQueryParameter" value="true"/>
31+
</b:bean>
32+
2833
<http>
2934
<intercept-url pattern="/**" access="authenticated"/>
3035
<intercept-url pattern="/requires-read-scope" access="hasAuthority('SCOPE_message:read')"/>
31-
<oauth2-resource-server>
36+
<oauth2-resource-server bearer-token-resolver-ref="bearerTokenResolver">
3237
<jwt jwk-set-uri="${jwk-set-uri:https://idp.example.org}"/>
3338
</oauth2-resource-server>
3439
</http>

‎oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java‎

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@ public final class DefaultBearerTokenResolver implements BearerTokenResolver {
5353
@Override
5454
public String resolve(final HttpServletRequest request) {
5555
final String authorizationHeaderToken = resolveFromAuthorizationHeader(request);
56-
final String parameterToken = isParameterTokenSupportedForRequest(request)
57-
? resolveFromRequestParameters(request) : null;
56+
final String parameterToken = resolveFromRequestParameters(request);
57+
5858
if (authorizationHeaderToken != null) {
5959
if (parameterToken != null) {
6060
BearerTokenError error = BearerTokenErrors
@@ -63,15 +63,12 @@ public String resolve(final HttpServletRequest request) {
6363
}
6464
return authorizationHeaderToken;
6565
}
66-
if (parameterToken != null && isParameterTokenEnabledForRequest(request)) {
67-
if (!StringUtils.hasText(parameterToken)) {
68-
BearerTokenError error = BearerTokenErrors
69-
.invalidRequest("The requested token parameter is an empty string");
70-
throw new OAuth2AuthenticationException(error);
71-
}
72-
return parameterToken;
66+
if (parameterToken != null && parameterToken.isBlank()) {
67+
BearerTokenError error = BearerTokenErrors
68+
.invalidRequest("The requested token parameter is an empty string");
69+
throw new OAuth2AuthenticationException(error);
7370
}
74-
return null;
71+
return parameterToken;
7572
}
7673

7774
/**
@@ -122,7 +119,10 @@ private String resolveFromAuthorizationHeader(HttpServletRequest request) {
122119
return matcher.group("token");
123120
}
124121

125-
private static String resolveFromRequestParameters(HttpServletRequest request) {
122+
private String resolveFromRequestParameters(HttpServletRequest request) {
123+
if (!isParameterTokenEnabledForRequest(request)) {
124+
return null;
125+
}
126126
String[] values = request.getParameterValues(ACCESS_TOKEN_PARAMETER_NAME);
127127
if (values == null || values.length == 0) {
128128
return null;
@@ -134,10 +134,6 @@ private static String resolveFromRequestParameters(HttpServletRequest request) {
134134
throw new OAuth2AuthenticationException(error);
135135
}
136136

137-
private boolean isParameterTokenSupportedForRequest(final HttpServletRequest request) {
138-
return isFormEncodedRequest(request) || isGetRequest(request);
139-
}
140-
141137
private static boolean isGetRequest(HttpServletRequest request) {
142138
return HttpMethod.GET.name().equals(request.getMethod());
143139
}

‎oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/server/authentication/ServerBearerTokenAuthenticationConverter.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -77,18 +77,18 @@ private String token(ServerHttpRequest request) {
7777
}
7878
return authorizationHeaderToken;
7979
}
80-
if (parameterToken != null && isParameterTokenSupportedForRequest(request)) {
81-
if (!StringUtils.hasText(parameterToken)) {
82-
BearerTokenError error = BearerTokenErrors
83-
.invalidRequest("The requested token parameter is an empty string");
84-
throw new OAuth2AuthenticationException(error);
85-
}
86-
return parameterToken;
80+
if (parameterToken != null && !StringUtils.hasText(parameterToken)) {
81+
BearerTokenError error = BearerTokenErrors
82+
.invalidRequest("The requested token parameter is an empty string");
83+
throw new OAuth2AuthenticationException(error);
8784
}
88-
return null;
85+
return parameterToken;
8986
}
9087

91-
private static String resolveAccessTokenFromRequest(ServerHttpRequest request) {
88+
private String resolveAccessTokenFromRequest(ServerHttpRequest request) {
89+
if (!isParameterTokenSupportedForRequest(request)) {
90+
return null;
91+
}
9292
List<String> parameterTokens = request.getQueryParams().get("access_token");
9393
if (CollectionUtils.isEmpty(parameterTokens)) {
9494
return null;

‎oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ public void resolveWhenHeaderWithInvalidCharactersIsPresentThenAuthenticationExc
110110

111111
@Test
112112
public void resolveWhenValidHeaderIsPresentTogetherWithFormParameterThenAuthenticationExceptionIsThrown() {
113+
this.resolver.setAllowFormEncodedBodyParameter(true);
113114
MockHttpServletRequest request = new MockHttpServletRequest();
114115
request.addHeader("Authorization", "Bearer " + TEST_TOKEN);
115116
request.setMethod("POST");
@@ -121,6 +122,7 @@ public void resolveWhenValidHeaderIsPresentTogetherWithFormParameterThenAuthenti
121122

122123
@Test
123124
public void resolveWhenValidHeaderIsPresentTogetherWithQueryParameterThenAuthenticationExceptionIsThrown() {
125+
this.resolver.setAllowUriQueryParameter(true);
124126
MockHttpServletRequest request = new MockHttpServletRequest();
125127
request.addHeader("Authorization", "Bearer " + TEST_TOKEN);
126128
request.setMethod("GET");
@@ -133,6 +135,7 @@ public void resolveWhenValidHeaderIsPresentTogetherWithQueryParameterThenAuthent
133135
// gh-10326
134136
@Test
135137
public void resolveWhenRequestContainsTwoAccessTokenQueryParametersThenAuthenticationExceptionIsThrown() {
138+
this.resolver.setAllowUriQueryParameter(true);
136139
MockHttpServletRequest request = new MockHttpServletRequest();
137140
request.setMethod("GET");
138141
request.addParameter("access_token", "token1", "token2");
@@ -143,6 +146,7 @@ public void resolveWhenRequestContainsTwoAccessTokenQueryParametersThenAuthentic
143146
// gh-10326
144147
@Test
145148
public void resolveWhenRequestContainsTwoAccessTokenFormParametersThenAuthenticationExceptionIsThrown() {
149+
this.resolver.setAllowFormEncodedBodyParameter(true);
146150
MockHttpServletRequest request = new MockHttpServletRequest();
147151
request.setMethod("POST");
148152
request.setContentType("application/x-www-form-urlencoded");
@@ -261,6 +265,25 @@ public void resolveWhenQueryParameterIsPresentAndNotSupportedThenTokenIsNotResol
261265
assertThat(this.resolver.resolve(request)).isNull();
262266
}
263267

268+
// gh-16038
269+
@Test
270+
void resolveWhenRequestContainsTwoAccessTokenFormParametersAndSupportIsDisabledThenTokenIsNotResolved() {
271+
MockHttpServletRequest request = new MockHttpServletRequest();
272+
request.setMethod("POST");
273+
request.setContentType("application/x-www-form-urlencoded");
274+
request.addParameter("access_token", "token1", "token2");
275+
assertThat(this.resolver.resolve(request)).isNull();
276+
}
277+
278+
// gh-16038
279+
@Test
280+
void resolveWhenRequestContainsTwoAccessTokenQueryParametersAndSupportIsDisabledThenTokenIsNotResolved() {
281+
MockHttpServletRequest request = new MockHttpServletRequest();
282+
request.setMethod("GET");
283+
request.addParameter("access_token", "token1", "token2");
284+
assertThat(this.resolver.resolve(request)).isNull();
285+
}
286+
264287
@Test
265288
public void resolveWhenQueryParameterIsPresentAndEmptyStringThenTokenIsNotResolved() {
266289
this.resolver.setAllowUriQueryParameter(true);

‎oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/server/authentication/ServerBearerTokenAuthenticationConverterTests.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,7 @@ public void resolveWhenHeaderWithInvalidCharactersIsPresentAndNotSubscribedThenN
157157
@Test
158158
public void resolveWhenValidHeaderIsPresentTogetherWithQueryParameterThenAuthenticationExceptionIsThrown() {
159159
// @formatter:off
160+
this.converter.setAllowUriQueryParameter(true);
160161
MockServerHttpRequest.BaseBuilder<?> request = MockServerHttpRequest.get("/")
161162
.queryParam("access_token", TEST_TOKEN)
162163
.header(HttpHeaders.AUTHORIZATION, "Bearer " + TEST_TOKEN);
@@ -205,6 +206,7 @@ public void resolveWhenQueryParameterIsPresentAndNotSupportedThenTokenIsNotResol
205206

206207
@Test
207208
void resolveWhenQueryParameterHasMultipleAccessTokensThenOAuth2AuthenticationException() {
209+
this.converter.setAllowUriQueryParameter(true);
208210
MockServerHttpRequest.BaseBuilder<?> request = MockServerHttpRequest.get("/")
209211
.queryParam("access_token", TEST_TOKEN, TEST_TOKEN);
210212
assertThatExceptionOfType(OAuth2AuthenticationException.class).isThrownBy(() -> convertToToken(request))
@@ -217,6 +219,14 @@ void resolveWhenQueryParameterHasMultipleAccessTokensThenOAuth2AuthenticationExc
217219

218220
}
219221

222+
// gh-16038
223+
@Test
224+
void resolveWhenRequestContainsTwoAccessTokenQueryParametersAndSupportIsDisabledThenTokenIsNotResolved() {
225+
MockServerHttpRequest.BaseBuilder<?> request = MockServerHttpRequest.get("/")
226+
.queryParam("access_token", TEST_TOKEN, TEST_TOKEN);
227+
assertThat(convertToToken(request)).isNull();
228+
}
229+
220230
private BearerTokenAuthenticationToken convertToToken(MockServerHttpRequest.BaseBuilder<?> request) {
221231
return convertToToken(request.build());
222232
}

0 commit comments

Comments
 (0)