From e5435a36ae8d1779535df3830d6d1faccba38caf Mon Sep 17 00:00:00 2001 From: Ian Young Date: Fri, 15 Apr 2016 13:26:59 +0000 Subject: [PATCH] Protect against CR characters in metadata. CR characters in metadata (which can only appear as the result of a character reference) can trigger the SSPCPP-684 bug in the Shibboleth SP. So, prevent them from appearing. --- mdx/common-beans.xml | 3 +++ mdx/validation-beans.xml | 9 +++++++++ .../{ukf-mda-0.9.0.jar => ukf-mda-0.9.1.jar} | Bin 45958 -> 47460 bytes 3 files changed, 12 insertions(+) rename tools/ukf-mda/{ukf-mda-0.9.0.jar => ukf-mda-0.9.1.jar} (79%) diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml index 5dfca2f0..3f9c4ab4 100644 --- a/mdx/common-beans.xml +++ b/mdx/common-beans.xml @@ -301,6 +301,9 @@ + + diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml index 785c9cd3..49d15315 100644 --- a/mdx/validation-beans.xml +++ b/mdx/validation-beans.xml @@ -323,6 +323,14 @@ ********************* --> + + + @@ -563,6 +571,7 @@ + diff --git a/tools/ukf-mda/ukf-mda-0.9.0.jar b/tools/ukf-mda/ukf-mda-0.9.1.jar similarity index 79% rename from tools/ukf-mda/ukf-mda-0.9.0.jar rename to tools/ukf-mda/ukf-mda-0.9.1.jar index a95ebdf53d924a96480a8df7b4af4dfe8ee03d7a..39e622c71625eb8c282d9740972b57ec01be3b41 100644 GIT binary patch delta 4780 zcmZ`+2{=^k`yMlPvS%54_MNe2Nw)0UL^O7?WoP=V8M2iuaS#z%#=cKPMJS@8h*CmB zB+4E|@gL6g{c?TRf39n;xzGLF@BO~#opYY&eG)%IKdnRQER12K)DQ?I1fm^~ZjeDI zKzjJASV7uvPq_ZbefSHIknn>*m_(XXi=YH-Nf01NBT*s(s3@>X!VF$eK(#?&3f1@% zRs+Ex^zX# zRR0Mh{)90)NL_cdyBpd&!2c}T#nWBd&DSL)r0(2cD6=)ozNy-my8~86#o16-t7^X7iA(IX^_aqbPurVJD}a|X7qY2x|9sgg@uazK#)Sf9 zRHXP1q7MDv_{$p5Y<%B?W1W-|7qMvhWsV-_SCJSXv@|x{G?Yi>TKvtam`b%IR87DQ#>IX36oT{s!-2LQE^^b6@Epr+h)y1V8n}_l`A7 zYyulBA@yO`^{x$el)ZLOl5W$JG1Jje#;lDpe3+)4d?Pomw{~Uoc{LL(_if?2R9Bx* zR7vPY#+O)C37fq+-s$8}C(ZUH;iLq(F zW$-#oCp_0D|BW2RYeXIHv!&d|c`IUDb&7BLiPnX%l4G+Hg_7&byyx{NRNt@k*w13# z6lnZnpn?g^$NW_5BY%;!@NvIKgLctR#I7Wgdtl`iW?=z8HLB`cwegIjeFDP?lF@yK`(#6ed+EQdJyWalt*FRtk|wIb}!x!e>Xw?DQ|32Spu#vPaln767h1*5`H>!vE%x^Heo}~3-TRQ8@vG) z#uSus&K50rQV2wWkn|67KMRDCk`i)|a&czIkAdkJ=fs{yL~EQ-QZQL>^KKBiWr6!d zR4a0mi1Z~gX+Yhik_?e!P{ok_zv-9?z|@f81~jdR_WZgml%T;$lQgUP zwCf^TzHp492302BXmSue38)4=fNfq;;A;RS@T#5-*N(ml1><_5ro{NNfGDmrQXTXH z_;p2rUkP+L1xx|xbTA(GD}jqRj_WEj&3~4!4dC;H0L>;oTmoQB9Ja4>|fSL@@5I03Rgtpc?SHeOc>S9^mDhw}l_P6iMU8uR#PW|}G z2V|O|VWw2Cwg-OVk<8m(wH%Kd3lqx7 zS{mPLj4?^BerVukrg+Y-)$w}4q92RWDji@js3bTHLEB%MV6$A%QX8E>E!2qmcB-zq z2w;Yp9VgjgL6>mFV%cvjBQfwFBP3FyNJQ4;GlvBKCHEK)y+5EzKg#b2*fEVpUrfjJc_zAU z)()_lSHlcZ)V*D7mrYTt^)OY~>+w&Q_`J=!hn*enC*jq69h%g?OG6VQ8G|F7s$?1M zb(Zfxv~oFL7m^cJ@B32>V`kKH9Q7T)l@i=MP zpI*D2=tfuR@ca7~JqPVzdQY^lLTGE5I#&IQGwYrML)Vy;QO?;Gbhu@c84pr)< z^k*81?+>QFDUJ<$9Cp7Rp@@`~x@}WZpB>c{b<$GqvD|=u6<{5hit(tloYlax{+^1> zzptp1SKmw~B;h@z!fi9iq|}0c=h@I7^=?Vd+{*xae#qoo9(+28C`{f+p+>iPnis}fyQA4k68(5omxmt!2a6)Uds z#M>e*uow4oNYWnG$u&#qWx1WSeA~!5?W*De_2gJI2ED*j-0*sK?b((x z#P5-<%SD!XHXQ1%>K2bNuUcn6nm(xJpjogX(F{j=de!c&il*3FCgC!Gme8j_3@ zc8M7Zg++6UQLDjpY$PbnGrTFnS znX)qGi0U$QcT~lo_{g}6N;U*Nu_cu%r3RLMJQmbbT0iMZX;NEt`K1|V^B-O*!w%AX z8Hp!NRUPw?cSQ|H#Ze5*cxy5;YkF6nrHc!u2=2`cZ@+;%mXJns4SA!PG>*VP(6Im_PVpfc0#(%uPIoB?VF|ct|F4J z+THcdGrtq>V9xAz-Fp-9fFkFuIlX!Vswbeub44fX(O#v%9G|$DI@)cluv6!Q;=RWK8x; zzo@?~L#fY;A1L_g^O2QoBrkAlfNbg4_Vq{6k!kfRI1UUp)Ppms5YbtGp*6LKXI-JF z<~_Qx04mol*ga-i^y^}yll;qO^DD2}%M-RDSFXLnO~KHSi1ND^eC!(fggfG{>oI4C zFIiOvQO7-9`o343dO~(`LddLEJ%4QW0fj;zeBgpRU%!sC*~hn zuFYT$$}gPpG-u%&83d9G|GWMk^jv^%i5G@6nMI8KmN+}yE)QkPkt?o3mL$r~!G0?! z8_Rm!bN=%?_`>-`j$ka?+)dW7^6?yxr8ze2Qnp70wmc?UQEmf*uYZ7k zg*V9Dt*|~U!GE7x5CFVVih|h80s9S{p!8TJ92yG;w5WN2>+Dp3Mdfk6gHug|g5p;N z7z9F24uQ!2b+2WyncPG%3vj-Y_E20sA_SBY#3mFFh~g2kAU{y7DFE;aQUUZ;Y~YOI zRdA@d(7$|e6$i+t6L@|xBF_Q9t3dO@sAn;91oL*nzpsA8d|HwyW&pm4&;Xb!TF}U) z8V-$+J&fI{mOotK%djcQXHW>lg#4f@n7!k)-7LLgd423Q#qHW3aO)+!z@ zk9OtsB0n7j@_`ou(K#aYwLBEI)hZtfA7CBv<%G@PCAdl*5$-u13dQR9!Fw>PgG2Y- z4!QU`1(174;4uD&+}8khAjO*n;Hf8WnshxJx{W5rcz~h?@Se}d%c}SjHjaX@amq&~ z#D){a2M0%i!_~!oF?A;)Y>+x(gH9X~heaKVr5acdg`+*}TM)u+s1lwo)g!`zm_uP_ z|NH}EZAf%J;iY9|gFwuV zOk|!)7f+7MZ2sAYD@*QNGzdRuH|6VXazG;o! z0hXJ%!7M;{bD_{;fTutRuxO?QIcEZ=bHK>}HOl@QhA{IKTNK_J^%m! delta 3152 zcmZWr2{=^iA0B7Mo_%eyN4BwM*VszgLqc79xVBK)$w;=FQhX9B*<}jDjF9Exrp3|> z=}HORB4xjdq`LnzbLKub&wrk0p7T5J`+o2D`+eUz=li|;8_IYO@jBX~FDbV}u%l%oqV#0G*3QAOW-Tu7NAdz`srs1-W-r7dvlqw{2!&tps3u5 zoQUIPEDz#HE|tt-dW+mr0zL}DV7Z=?94p(&=Bw~#wGJOmblmLy)0qQAY7l7BnpAAE&Hl_B3mO59xdG&ik@2$CuPaRa>ee+rqJsTT) zXxYnPVlym8^he_7S-du37B_9NYmc7+UiOQ5Nm~qeg#X}9tS|`+YLm{nqH;|1nzeklW9RHZ)nNBsG2i{mSL}9n z`8AsRDJZ|G+QvGHMZSS5i)&dr4^Q9?K!g9Dd;# zdnfjw_c$u-YZrIH{;2PYAM*JNs=1s4E9Go`EHo_Gi7T9Q?yJ3&*;mxiqJTn^f@Ae6 zd&&pOuLNaVS@UKn43b=%SnC}-j-fw%NS?glq0Pf-ext7=V#7y?yYH^>%UH$dYISHM z&C^aqT$6I8R;F|KpEG%chuVBvA-=l|vukM*;Q1*6rn-D>e0*GP;aTyZQxhsmkkT@& zba4suS~0qN*F9fz$(oqWUlYO&4~`Wltx{a&S<^=)P7JqHDnuCj&G-n8ckl}Pr<^;u zoF|zkO$vBIeqhWYOtn;+?i%&QrT0wK{q3A-*)|xrklu8)hE??w;W+knO}j3CSdqD4 zoqOQP;N*4IwB3TDZwfQ{+FxfSbW9~r8*@K`95cVpf0yPGzyCYORuS#SICKD#TMEkg z;mJQeJj7kXvZ^J|k>uV^+4Zzq{Ec;aZGJFY+-<>9RrS1pqK~<$AHH-5Mprz~9v{Gq z?3H+yly4aP+oPb=ow|f2<+`~I-j}0woDZX}swu^>>=e@sFFp|#@&}pfmAl#W>_iDI zcVy+_tCxENVmsyZo}@PtH}bn)WZchJfc&cM*@TkZAG(L@_t>9KTpx*SguCIDYt%HTdK8N_ek5PITk?W9|IRNUuqX-hMl@p`0+)#4UWdcx9&0%qRQ4Y1C5G#WM%|X|4

KWX}&--lu2XLKSarb*9d%oqcqGYnbr<)50d- zqKVss-4ZR$QAS-eJ?$30ht#*C@84VDh_-jyB-(qD;u6*k*djwx(vH+!C;Co5LjM{l zmMr6uz0!Ino>afp|421?8N%b{KYL75QA_4M_yEgx9`noV=LivXpJT*u4Y#CPy_zph zg-|D}g8td8n5?}}{&wPgMWhqn% z`S)-0E$`nQkG$p-_)Dnwc@07Jf-0M_Y!dsV#{2s*l6ZFi!2CW+$0FIAZ*pv*c>xIX zzoF2Qmpug%CKEBnW9^5IZfRVZdq;4zW#_m#AlXf3MWJ|hqEPgMT^Pl|!NEA#!F){+ z!6nk#-c^(0sHxMWtwYh)b&K5KanjV*)R|GSRa1F7NG0pi$fJ9wZ8Z8d)K=^o)rS5Y z(6AX(9dfX>XW7Z^(sR|_C9kNU&;u%Pcs68j{SJa>Vdn@w_2lYl_`HsR|BkjSkTCkc zhT^AV90i7NDhTecQ z=;$u!piw9`HWW(prz$GXIf(;vE-6?n3_KflFvP?W1yBKt?buN$-EHExyFgFoh*xBI5HOM@?v1R{z{Cw=!*}EVcaAb^u)`7&Tx6~jl2WNZwCbn-HTx2 z{6L~k5Wyp1+&>D&4Z&Gv!RJ5N2e4q^m4aJaxorjO$AVRgCSyrQd&SpL@RAzAdt$Ur zl$8j~o2`&6FEwMKm1IVi_-tMfowkcnDI?QwF!wN>$w>p=M&=6m-orw?SqOfM3tYa0 z`;U7Ka|+-m4hy;q*#N$US*3jo>{-O*B|#~S)0=WYg7N(8V6{{TOto+!82tD{J=cME znF3I6W$H{?;a$7|V;U;-w-NaY(7U{!zYp5m%C)7-)xdPCkPLmQpI>RiZ9=bdhS01{ RlvfR