Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

DefaultLoginPageGeneratingFilter escapes OAuth2 ClientRegistrations

Browse Source 
Fixes gh-5394
This commit is contained in:
Joe Grandja
2018-05-29 09:50:14 -04:00
parent b3ca598679
commit 48ef7c966d
2 changed files with 29 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java
View File

@@ -15,6 +15,16 @@
*/
package org.springframework.security.web.authentication;
import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.Mockito.mock;
import java.util.Collections;
import java.util.Locale;
import javax.servlet.FilterChain;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.junit.Test;
import org.springframework.context.support.MessageSourceAccessor;
import org.springframework.mock.web.MockHttpServletRequest;
@@ -26,15 +36,6 @@ import org.springframework.security.core.SpringSecurityMessageSource;
import org.springframework.security.web.WebAttributes;
import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
import javax.servlet.FilterChain;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Collections;
import java.util.Locale;
import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.Mockito.mock;
/**
*
* @author Luke Taylor
@@ -187,4 +188,21 @@ public class DefaultLoginPageGeneratingFilterTests {
filter.doFilter(request, new MockHttpServletResponse(), chain);
}
// gh-5394
@Test
public void generatesForOAuth2LoginAndEscapesClientName() throws Exception {
DefaultLoginPageGeneratingFilter filter = new DefaultLoginPageGeneratingFilter();
filter.setLoginPageUrl(DefaultLoginPageGeneratingFilter.DEFAULT_LOGIN_PAGE_URL);
filter.setOauth2LoginEnabled(true);
String clientName = "Google < > \" \' &";
filter.setOauth2AuthenticationUrlToClientName(
Collections.singletonMap("/oauth2/authorization/google", clientName));
MockHttpServletResponse response = new MockHttpServletResponse();
filter.doFilter(new MockHttpServletRequest("GET", "/login"), response, chain);
assertThat(response.getContentAsString()).contains("<a href=\"/oauth2/authorization/google\">Google &lt; &gt; &quot; &#39; &amp;</a>");
}
}