Sanitize registration key in error page

Author: rmiccoli

iam-login-service/src/main/java/it/infn/mw/iam/registration/DefaultRegistrationRequestService.java

@@ -15,6 +15,7 @@
  */
 package it.infn.mw.iam.registration;
 
+import static it.infn.mw.iam.authn.x509.IamX509PreauthenticationProcessingFilter.X509_CREDENTIAL_SESSION_KEY;
 import static it.infn.mw.iam.core.IamRegistrationRequestStatus.APPROVED;
 import static it.infn.mw.iam.core.IamRegistrationRequestStatus.CONFIRMED;
 import static it.infn.mw.iam.core.IamRegistrationRequestStatus.NEW;
@@ -35,7 +36,6 @@
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
-import static it.infn.mw.iam.authn.x509.IamX509PreauthenticationProcessingFilter.X509_CREDENTIAL_SESSION_KEY;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -124,7 +124,6 @@ public class DefaultRegistrationRequestService
 
   public static final String NICKNAME_ATTRIBUTE_KEY = "nickname";
 
-  @Autowired
   public DefaultRegistrationRequestService(LabelDTOConverter labelConverter,
       IamProperties iamProperties) {
     this.labelConverter = labelConverter;
@@ -266,8 +265,7 @@ public List<RegistrationRequestDto> listPendingRequests() {
   public RegistrationRequestDto confirmRequest(String confirmationKey) {
 
     IamRegistrationRequest request = requestRepository.findByAccountConfirmationKey(confirmationKey)
-      .orElseThrow(() -> new ScimResourceNotFoundException(String
-        .format("No registration request found for registration_key [%s]", confirmationKey)));
+      .orElseThrow(() -> new ScimResourceNotFoundException("No registration request found"));
 
     return handleConfirm(request);
   }

iam-login-service/src/main/webapp/WEB-INF/views/iam/confirmRequest.jsp

@@ -17,6 +17,7 @@
 --%>
 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
 <%@ taglib prefix="t" tagdir="/WEB-INF/tags/iam"%>
+<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
 <t:page title="Verify registration request">
   <h1 class="text-center">Verify registration request</h1>
   <div id="verify-registration-form">
@@ -25,7 +26,7 @@
       <form name="confirmationForm"
           action="${pageContext.request.contextPath.endsWith('/') ? pageContext.request.contextPath : pageContext.request.contextPath.concat('/') }registration/verify"
           method="post">
-        <input type="hidden" name="token" value="${token}" />
+        <input type="hidden" name="token" value="${fn:escapeXml(token)}" />
         <input class="btn btn-primary" type="submit" name="confirm_registration_request" value="Confirm Request" />
       </form>
     </div>

iam-login-service/src/test/java/it/infn/mw/iam/test/registration/RegistrationApiControllerTests.java

@@ -0,0 +1,75 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.test.registration;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.context.SpringBootTest.WebEnvironment;
+
+import io.restassured.RestAssured;
+import it.infn.mw.iam.test.TestUtils;
+
+@SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT)
+class RegistrationApiControllerTests {
+
+  @Value("${local.server.port}")
+  private Integer iamPort;
+
+  @BeforeAll
+  static void init() {
+    TestUtils.initRestAssured();
+  }
+
+  @Test
+  void testTokenIsNotReflectedInErrorPage() {
+
+    String response = RestAssured.given()
+      .port(iamPort)
+      .contentType("application/x-www-form-urlencoded")
+      .formParam("token", "<img src=x onerror=alert(1)>")
+      .when()
+      .post("/registration/verify")
+      .then()
+      .statusCode(200)
+      .extract()
+      .asString();
+
+    assertThat(response).doesNotContain("<img src=x onerror=alert(1)>")
+      .contains("No registration request found");
+  }
+
+  @Test
+  void testTokenIsEscapedInConfirmPage() {
+
+    String payload = "\"><img src=x onerror=alert(1)>";
+
+    String response = RestAssured.given()
+      .port(iamPort)
+      .pathParam("token", payload)
+      .when()
+      .get("/registration/verify/{token}")
+      .then()
+      .statusCode(200)
+      .extract()
+      .asString();
+
+    assertThat(response).doesNotContain("<img src=x onerror=alert(1)>");
+  }
+}