-
Notifications
You must be signed in to change notification settings - Fork 6.1k
Improve authoritiesClaimName validation in JwtGrantedAuthoritiesConverter #17247
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improve authoritiesClaimName validation in JwtGrantedAuthoritiesConverter #17247
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the PR, @chanbinme! I've left my feedback inline.
...framework/security/oauth2/server/resource/authentication/JwtGrantedAuthoritiesConverter.java
Outdated
Show resolved
Hide resolved
...framework/security/oauth2/server/resource/authentication/JwtGrantedAuthoritiesConverter.java
Show resolved
Hide resolved
...work/security/oauth2/server/resource/authentication/JwtGrantedAuthoritiesConverterTests.java
Outdated
Show resolved
Hide resolved
b6b8aa0
to
39b5cf5
Compare
Hi @jzheaux, Thank you so much for your helpful feedback! Thanks again for your time and support! |
...framework/security/oauth2/server/resource/authentication/JwtGrantedAuthoritiesConverter.java
Outdated
Show resolved
Hide resolved
Hi @jzheaux 👋 No rush at all, just wanted to make sure this didn't get lost in notifications. |
This commit simplfies the logic in JwtGrantedAuthoritiesConverter to no longer need the authoritiesClaimName field. Signed-off-by: chanbinme <[email protected]>
92a13c2
to
3293f07
Compare
Thanks for the updates, @chanbinme! This is now merged into |
Summary
Use
StringUtils.hasText()
instead of null check ingetAuthoritiesClaimName()
to properly handle empty strings and whitespace-only strings.Problem
The current null check (
!= null
) incorrectly treats empty strings (""
) and whitespace-only strings (" "
) as valid claim names. WhilesetAuthoritiesClaimName()
validates withAssert.hasText()
, the field can be set through other means (reflection, constructors, etc.) that bypass this validation.Changes
!= null
check withStringUtils.hasText()
Testing
Added parameterized tests covering empty strings, whitespace strings, and null values using
ReflectionTestUtils
to simulate edge cases.Impact
This is a straightforward bug fix that improves robustness without breaking changes.