Skip to content

Commit 0b6e84b

Browse files
marcusdacoregiomarcusdacoregio
committed
Merge branch '5.8.x' into 6.0.x
Closes gh-13141
2 parents dfbfa91 + 8d5304f commit 0b6e84b

File tree

6 files changed

+20
-20
lines changed

6 files changed

+20
-20
lines changed

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/Saml2WebSsoAuthenticationRequestFilter.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -145,7 +145,7 @@ private String createSamlPostRequestFormData(Saml2PostAuthenticationRequest auth
145145
html.append("<!DOCTYPE html>\n");
146146
html.append("<html>\n").append(" <head>\n");
147147
html.append(" <meta http-equiv=\"Content-Security-Policy\" ")
148-
.append("content=\"script-src 'sha256-t+jmhLjs1ocvgaHBJsFcgznRk68d37TLtbI3NE9h7EU='\">\n");
148+
.append("content=\"script-src 'sha256-oZhLbc2kO8b8oaYLrUc7uye1MgVKMyLtPqWR4WtKF+c='\">\n");
149149
html.append(" <meta charset=\"utf-8\" />\n");
150150
html.append(" </head>\n");
151151
html.append(" <body>\n");
@@ -176,8 +176,8 @@ private String createSamlPostRequestFormData(Saml2PostAuthenticationRequest auth
176176
html.append(" </noscript>\n");
177177
html.append(" </form>\n");
178178
html.append(" \n");
179+
html.append(" <script>window.onload = function() { document.forms[0].submit(); }</script>\n");
179180
html.append(" </body>\n");
180-
html.append(" <script>window.onload = () => document.forms[0].submit();</script>\n");
181181
html.append("</html>");
182182
return html.toString();
183183
}

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2LogoutRequestFilter.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -215,10 +215,10 @@ private String createSamlPostRequestFormData(String location, String saml, Strin
215215
html.append("<!DOCTYPE html>\n");
216216
html.append("<html>\n").append(" <head>\n");
217217
html.append(" <meta http-equiv=\"Content-Security-Policy\" ")
218-
.append("content=\"script-src 'sha256-t+jmhLjs1ocvgaHBJsFcgznRk68d37TLtbI3NE9h7EU='\">\n");
218+
.append("content=\"script-src 'sha256-oZhLbc2kO8b8oaYLrUc7uye1MgVKMyLtPqWR4WtKF+c='\">\n");
219219
html.append(" <meta charset=\"utf-8\" />\n");
220220
html.append(" </head>\n");
221-
html.append(" <body onload=\"document.forms[0].submit()\">\n");
221+
html.append(" <body>\n");
222222
html.append(" <noscript>\n");
223223
html.append(" <p>\n");
224224
html.append(" <strong>Note:</strong> Since your browser does not support JavaScript,\n");
@@ -246,8 +246,8 @@ private String createSamlPostRequestFormData(String location, String saml, Strin
246246
html.append(" </noscript>\n");
247247
html.append(" </form>\n");
248248
html.append(" \n");
249+
html.append(" <script>window.onload = function() { document.forms[0].submit(); }</script>\n");
249250
html.append(" </body>\n");
250-
html.append(" <script>window.onload = () => document.forms[0].submit();</script>\n");
251251
html.append("</html>");
252252
return html.toString();
253253
}

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2RelyingPartyInitiatedLogoutSuccessHandler.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -119,10 +119,10 @@ private String createSamlPostRequestFormData(String location, String saml, Strin
119119
html.append("<!DOCTYPE html>\n");
120120
html.append("<html>\n").append(" <head>\n");
121121
html.append(" <meta http-equiv=\"Content-Security-Policy\" ")
122-
.append("content=\"script-src 'sha256-t+jmhLjs1ocvgaHBJsFcgznRk68d37TLtbI3NE9h7EU='\">\n");
122+
.append("content=\"script-src 'sha256-oZhLbc2kO8b8oaYLrUc7uye1MgVKMyLtPqWR4WtKF+c='\">\n");
123123
html.append(" <meta charset=\"utf-8\" />\n");
124124
html.append(" </head>\n");
125-
html.append(" <body onload=\"document.forms[0].submit()\">\n");
125+
html.append(" <body>\n");
126126
html.append(" <noscript>\n");
127127
html.append(" <p>\n");
128128
html.append(" <strong>Note:</strong> Since your browser does not support JavaScript,\n");
@@ -150,8 +150,8 @@ private String createSamlPostRequestFormData(String location, String saml, Strin
150150
html.append(" </noscript>\n");
151151
html.append(" </form>\n");
152152
html.append(" \n");
153+
html.append(" <script>window.onload = function() { document.forms[0].submit(); }</script>\n");
153154
html.append(" </body>\n");
154-
html.append(" <script>window.onload = () => document.forms[0].submit();</script>\n");
155155
html.append("</html>");
156156
return html.toString();
157157
}

‎saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/Saml2WebSsoAuthenticationRequestFilterTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -170,8 +170,8 @@ public void doFilterWhenPostFormDataIsPresent() throws Exception {
170170
this.filter.doFilterInternal(this.request, this.response, this.filterChain);
171171
assertThat(this.response.getHeader("Location")).isNull();
172172
assertThat(this.response.getContentAsString()).contains(
173-
"<meta http-equiv=\"Content-Security-Policy\" content=\"script-src 'sha256-t+jmhLjs1ocvgaHBJsFcgznRk68d37TLtbI3NE9h7EU='\">")
174-
.contains("<script>window.onload = () => document.forms[0].submit();</script>")
173+
"<meta http-equiv=\"Content-Security-Policy\" content=\"script-src 'sha256-oZhLbc2kO8b8oaYLrUc7uye1MgVKMyLtPqWR4WtKF+c='\">")
174+
.contains("<script>window.onload = function() { document.forms[0].submit(); }</script>")
175175
.contains("<form action=\"https://sso-url.example.com/IDP/SSO\" method=\"post\">")
176176
.contains("<input type=\"hidden\" name=\"SAMLRequest\"")
177177
.contains("value=\"" + relayStateEncoded + "\"");

‎saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2LogoutRequestFilterTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -118,8 +118,8 @@ public void doFilterWhenSamlRequestThenPosts() throws Exception {
118118
assertThat(content).contains(Saml2ParameterNames.SAML_RESPONSE);
119119
assertThat(content).contains(registration.getAssertingPartyDetails().getSingleLogoutServiceResponseLocation());
120120
assertThat(content).contains(
121-
"<meta http-equiv=\"Content-Security-Policy\" content=\"script-src 'sha256-t+jmhLjs1ocvgaHBJsFcgznRk68d37TLtbI3NE9h7EU='\">");
122-
assertThat(content).contains("<script>window.onload = () => document.forms[0].submit();</script>");
121+
"<meta http-equiv=\"Content-Security-Policy\" content=\"script-src 'sha256-oZhLbc2kO8b8oaYLrUc7uye1MgVKMyLtPqWR4WtKF+c='\">");
122+
assertThat(content).contains("<script>window.onload = function() { document.forms[0].submit(); }</script>");
123123
verify(this.securityContextHolderStrategy).getContext();
124124
}
125125

‎saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2RelyingPartyInitiatedLogoutSuccessHandlerTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -98,8 +98,8 @@ public void onLogoutSuccessWhenPostThenPostsToAssertingParty() throws Exception
9898
assertThat(content).contains(Saml2ParameterNames.SAML_REQUEST);
9999
assertThat(content).contains(registration.getAssertingPartyDetails().getSingleLogoutServiceLocation());
100100
assertThat(content).contains(
101-
"<meta http-equiv=\"Content-Security-Policy\" content=\"script-src 'sha256-t+jmhLjs1ocvgaHBJsFcgznRk68d37TLtbI3NE9h7EU='\">");
102-
assertThat(content).contains("<script>window.onload = () => document.forms[0].submit();</script>");
101+
"<meta http-equiv=\"Content-Security-Policy\" content=\"script-src 'sha256-oZhLbc2kO8b8oaYLrUc7uye1MgVKMyLtPqWR4WtKF+c='\">");
102+
assertThat(content).contains("<script>window.onload = function() { document.forms[0].submit(); }</script>");
103103
}
104104

105105
private Saml2Authentication authentication(RelyingPartyRegistration registration) {

0 commit comments

Comments
 (0)