Sanitise and UTF-8 url decode cert before base64 decoding #2438
Conversation
anjuchamantha
requested review from
ChinthakaJ98,
DMHP,
Shenali-SJ and
RivinduM
| private X509Certificate parseCertificate(String content) throws CertificateException, UnsupportedEncodingException { | ||
|
|
||
| if (log.isDebugEnabled()) { | ||
| log.debug("Trying to parse the client certificate: " + content); |
There was a problem hiding this comment.
do we need to log certifiate now?ince we know the reason.
There was a problem hiding this comment.
Removed with 15b4763
|
PR builder started |
|
PR builder completed |
There was a problem hiding this comment.
Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/8872652153
|
PR builder started |
|
PR builder completed |
There was a problem hiding this comment.
Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/8873407180
Purpose
There is a bug in
CertificateBasedTokenBinderwhen decoding the certificates passed via a header which contains whitespaces, newlines and url encoded certs. This throws a 500 server error. This PR fixes this by sanitising and url decoding before base64 decoding.Related Issues
wso2/product-is#20229