String samlProxyHeader = "";
for (int idx = 0; idx < namedValues.length; idx++) {
if ("RelayState".equals(namedValues[idx].getName())) {
if (this.samlProxyConfig.doInjectRelayState()) {
String newRelayState = getInjectedRelayState();
namedValues[idx] = new NamedValue(namedValues[idx].getName(), newRelayState);
samlProxyHeader += "injected relay state;";
}
}
if (false == "SAMLResponse".equals(namedValues[idx].getName())) {
continue;
}
samlResponseMessage = true;
try {
if (this.samlProxyConfig.doReplay()) {
String newSamlResponse = replaySamlResponse();
namedValues[idx] = new NamedValue(namedValues[idx].getName(), newSamlResponse);
samlProxyHeader += "replayed;";
}
if (this.samlProxyConfig.doSignWrapAttack()) {
String newSamlResponse = signatureWrapping(namedValues[idx].getValue());
namedValues[idx] = new NamedValue(namedValues[idx].getName(), newSamlResponse);
samlProxyHeader += "signature wrapping;";
}
if (this.samlProxyConfig.doInjectAttribute()) {
String newSamlResponse = injectAttribute(namedValues[idx].getValue());
namedValues[idx] = new NamedValue(namedValues[idx].getName(), newSamlResponse);
samlProxyHeader += "injected attribute;";
}
if (this.samlProxyConfig.doInjectSubject()) {
String newSamlResponse = injectSubject(namedValues[idx].getValue());
namedValues[idx] = new NamedValue(namedValues[idx].getName(), newSamlResponse);
samlProxyHeader += "injected subject;";
}
if (this.samlProxyConfig.doInjectPublicDoctype()) {
String newSamlResponse = injectPublicDoctype(namedValues[idx].getValue());
namedValues[idx] = new NamedValue(namedValues[idx].getName(), newSamlResponse);
samlProxyHeader += "injected public doctype;";
}
if (this.samlProxyConfig.doRemoveAssertionSignature()) {
String newSamlResponse = removeSamlAssertionSignature(namedValues[idx].getValue());
namedValues[idx] = new NamedValue(namedValues[idx].getName(), newSamlResponse);
samlProxyHeader += "removed assertion signature;";
}
if (this.samlProxyConfig.doSignSamlMessage()) {
String newSamlResponse = signSamlMessage(namedValues[idx].getValue());
namedValues[idx] = new NamedValue(namedValues[idx].getName(), newSamlResponse);
samlProxyHeader += "sign;";
} else if (this.samlProxyConfig.doRemoveSignature()) {
String newSamlResponse = removeSamlResponseSignature(namedValues[idx].getValue());
namedValues[idx] = new NamedValue(namedValues[idx].getName(), newSamlResponse);
samlProxyHeader += "removed signature;";
} else {
if (this.samlProxyConfig.doCorruptSignature()) {
String newSamlResponse = corruptSamlResponseSignature(namedValues[idx].getValue());
namedValues[idx] = new NamedValue(namedValues[idx].getName(), newSamlResponse);
samlProxyHeader += "corrupted signature;";
}
if (this.samlProxyConfig.doInjectRemoteReference()) {
String newSamlResponse = injectRemoteReference(namedValues[idx].getValue());
namedValues[idx] = new NamedValue(namedValues[idx].getName(), newSamlResponse);
samlProxyHeader += "injected remote reference;";
}
}
} catch (Exception ex) {
this._logger.log(Level.WARNING, "could not corrupt the SAML Response signature: {0}", ex.getMessage());
continue;
}
}
if (false == samlResponseMessage) {
return;
}
StringBuilder newBody = new StringBuilder();
for (int idx = 0; idx < namedValues.length; idx++) {
NamedValue namedValue = namedValues[idx];
if (0 != newBody.length()) {
newBody.append("&");
}
newBody.append(namedValue.getName());
newBody.append("=");
newBody.append(namedValue.getValue());
}
request.setContent(newBody.toString().getBytes());
if (samlProxyHeader.length() > 0) {
request.addHeader("X-SAMLProxy", samlProxyHeader);