From 4da0d94b96e662b8dffe281d0a2de812f11cda71 Mon Sep 17 00:00:00 2001
From: Jacek Kowalski <Jacek@jacekk.info>
Date: Sun, 10 May 2020 20:40:15 +0000
Subject: [PATCH] Filter potentially dangerous input in GitHub Actions workflows
---
src/main/java/org/keycloak/protocol/cas/utils/ContentTypeHelper.java | 13 ++++++++++---
1 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/src/main/java/org/keycloak/protocol/cas/utils/ContentTypeHelper.java b/src/main/java/org/keycloak/protocol/cas/utils/ContentTypeHelper.java
index e842ef0..b5ad8a5 100644
--- a/src/main/java/org/keycloak/protocol/cas/utils/ContentTypeHelper.java
+++ b/src/main/java/org/keycloak/protocol/cas/utils/ContentTypeHelper.java
@@ -3,6 +3,7 @@
import org.jboss.resteasy.spi.HttpRequest;
import org.keycloak.protocol.cas.CASLoginProtocol;
+import javax.ws.rs.BadRequestException;
import javax.ws.rs.core.*;
public class ContentTypeHelper {
@@ -19,9 +20,15 @@
public MediaType selectResponseType() {
String format = uriInfo.getQueryParameters().getFirst(CASLoginProtocol.FORMAT_PARAM);
if (format != null && !format.isEmpty()) {
- request.getMutableHeaders().add(HttpHeaders.ACCEPT, "application/" + format);
+ //if parameter is set, it overrides all header values (see spec section 2.5.1)
+ request.getMutableHeaders().putSingle(HttpHeaders.ACCEPT, "application/" + format.toLowerCase());
}
- Variant variant = restRequest.selectVariant(Variant.mediaTypes(MediaType.APPLICATION_XML_TYPE, MediaType.APPLICATION_JSON_TYPE).build());
- return variant == null ? MediaType.APPLICATION_XML_TYPE : variant.getMediaType();
+ try {
+ Variant variant = restRequest.selectVariant(Variant.mediaTypes(MediaType.APPLICATION_XML_TYPE, MediaType.APPLICATION_JSON_TYPE).build());
+ return variant == null ? MediaType.APPLICATION_XML_TYPE : variant.getMediaType();
+ } catch (BadRequestException e) {
+ //the default Accept header set by java.net.HttpURLConnection is invalid (cf. RESTEASY-960)
+ return MediaType.APPLICATION_XML_TYPE;
+ }
}
}
--
Gitblit v1.9.1