mirror of
https://github.com/iflytek/skillhub.git
synced 2026-09-05 08:05:56 +00:00
821c7e1333
B1 — Ticket log leak: log.debug now records only the validation path (resolvedProtocolVersion().validatePath()); the catch block surfaces only e.getClass().getSimpleName() instead of e.getMessage(), preventing the full validation URL (with ticket query param) from reaching log streams. B2 — emailVerified semantics: CasIdentityClaims.emailVerified() now constantly returns false. CAS passes through email attributes from the upstream directory (LDAP/AD) without cryptographic verification, so returning true was a false signal to any AccessPolicy that gates on it. B3 — Exception package: AccountPendingException and AccountDisabledException moved from auth.oauth to auth.identity; all import sites updated. OAuth, CAS, and future SAML/OIDC flows now import from the neutral package. S6 — Login CSRF via state nonce: login() generates a cryptographically random 24-byte nonce, stores it in the session under a CAS-specific key (skillhub.cas.state), and appends state=<nonce> to the service URL that is sent to the CAS server. callback() validates the incoming state param against the session value before touching the ticket; a mismatch short- circuits to redirect:/login?error=invalid_state. The CAS-specific session key (skillhub.cas.state / skillhub.cas.returnTo) also eliminates the previous shared-key concurrency hazard with the OAuth flow. |
||
|---|---|---|
| .. | ||
| .mvn | ||
| scripts | ||
| skillhub-app | ||
| skillhub-auth | ||
| skillhub-domain | ||
| skillhub-infra | ||
| skillhub-notification | ||
| skillhub-search | ||
| skillhub-storage | ||
| .dockerignore | ||
| Dockerfile | ||
| Dockerfile.dev | ||
| mvnw | ||
| mvnw.cmd | ||
| pom.xml | ||