org.forgerock.openam.shared.security.whitelist

Class RedirectUrlValidator<T>

java.lang.Object

org.forgerock.openam.shared.security.whitelist.RedirectUrlValidator<T>

Type Parameters:

T - The type of the configuration information that is provided to find the collection of valid domains.

public class RedirectUrlValidator<T>
extends Object

Validates the provided redirect URL against the list of valid goto URL domains.

Field Summary

Fields

Modifier and Type	Field and Description
static String	GOTO Go to url query parameter name.
static String	GOTO_ON_FAIL Go to on fail query parameter name.

Constructor Summary

Constructors

Constructor and Description
RedirectUrlValidator(ValidDomainExtractor<T> domainExtractor) Constructs a new RedirectUrlValidator instance.

Method Summary

Modifier and Type	Method and Description
String	getAndDecodeParameter(javax.servlet.http.HttpServletRequest request, String paramName) Helper function to retrieve a field from the provided request's query parameters.
String	getRedirectUrl(T configInfo, String gotoUrl, String alternateUrl) Returns the appopriate redirectUrl, given the options of the provided URL and the default one, as well as a configuration.
String	getValueFromJson(org.forgerock.json.JsonValue input, String paramName) Helper function to retrieve a field from the provided request's JSON POST data.
boolean	isRedirectUrlValid(String url, T configInfo) Validates the provided redirect URL against the collection of valid goto URL domains found based on the configuration info.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

GOTO

public static final String GOTO

Go to url query parameter name.

See Also:

Constant Field Values

GOTO_ON_FAIL

public static final String GOTO_ON_FAIL

Go to on fail query parameter name.

See Also:

Constant Field Values

Constructor Detail

RedirectUrlValidator

public RedirectUrlValidator(ValidDomainExtractor<T> domainExtractor)

Constructs a new RedirectUrlValidator instance.

Parameters:

domainExtractor - A ValidDomainExtractor instance.

Method Detail

isRedirectUrlValid

public boolean isRedirectUrlValid(String url,
                                  T configInfo)

Validates the provided redirect URL against the collection of valid goto URL domains found based on the configuration info.

Parameters:

url - The URL that needs to be validated. May be null.

configInfo - The necessary information about the configuration to determine the collection of valid goto URL domains. May not be null.

Returns:

true if the provided URL is valid, false otherwise.

getRedirectUrl

public String getRedirectUrl(T configInfo,
                             String gotoUrl,
                             String alternateUrl)

Returns the appopriate redirectUrl, given the options of the provided URL and the default one, as well as a configuration. The configuration determines whether gotoUrl is valid and complies with the configuration's URL policy. If so, the gotoUrl is returned, otherwise the alternateUrl is returned. In the case where the alternateUrl is null, null is returned.

Parameters:

configInfo - Config in the given type which informs the collection of valid domain URLs.

gotoUrl - The goto URL to compare against the config. If null alternateUrl will be returned.

alternateUrl - The URL to default to. May be null.

Returns:

The URL to use, or null if no URL is appropriate.

getAndDecodeParameter

public String getAndDecodeParameter(javax.servlet.http.HttpServletRequest request,
                                    String paramName)

Helper function to retrieve a field from the provided request's query parameters. This exists for the old-style interfaces, and takes the parameter name as an argument also. If the queryParameters contain the "encoded" parameter, then the result is Base64 decoded before being returned.

Parameters:

request - Request containing the parameters to retrieve.

paramName - The name of the parameter whose value to (possibly decode) return.

Returns:

The (possibly decoded) value of the paramName's key within the requests's query parameters.

getValueFromJson

public String getValueFromJson(org.forgerock.json.JsonValue input,
                               String paramName)

Helper function to retrieve a field from the provided request's JSON POST data. This exists for the new-style interfaces, and takes the parameter name as an argument also.

Parameters:

input - JsonValue containing the key "goto" and a paired URL.

paramName - The key whose value to attempt to read.

Returns:

The String representation fo the "goto" key's value, or null.