From 0b1e744b6b1c53f0fae10cfabb07a5db18aabd97 Mon Sep 17 00:00:00 2001 From: Tim van Dijen Date: Sat, 29 Nov 2025 12:48:02 +0100 Subject: [PATCH 1/2] Fix typo + inconsistency --- .../Features/AcsTinkering.feature | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/OpenConext/EngineBlockFunctionalTestingBundle/Features/AcsTinkering.feature b/src/OpenConext/EngineBlockFunctionalTestingBundle/Features/AcsTinkering.feature index 785ec527f..a79e39ad2 100644 --- a/src/OpenConext/EngineBlockFunctionalTestingBundle/Features/AcsTinkering.feature +++ b/src/OpenConext/EngineBlockFunctionalTestingBundle/Features/AcsTinkering.feature @@ -1,7 +1,7 @@ Feature: In order to prevent XSS attacks As a user - I need EB to filter malicious asc values in AuthnRequests + I need EB to filter malicious ACS values in AuthnRequests Background: Given an EngineBlock instance on "dev.openconext.local" @@ -10,8 +10,8 @@ Feature: And an Identity Provider named "AlwaysAuth" And a Service Provider named "Malicious SP" And a Service Provider named "Malconfigured SP" - And SP "Malicious SP" is set with acs location "javascript:alert('Hello world')" - And SP "Malconfigured SP" is set with acs location "sp.example.com" + And SP "Malicious SP" is set with ACS location "javascript:alert('Hello world')" + And SP "Malconfigured SP" is set with ACS location "sp.example.com" Scenario: The Malicious SP AuthnRequest is denied by EngineBlock Given I log in at "Malicious SP" From e650852b556014234f0918a9b1505acaa06cdfed Mon Sep 17 00:00:00 2001 From: Tim van Dijen Date: Sat, 29 Nov 2025 12:57:08 +0100 Subject: [PATCH 2/2] Fix unit tests --- .../Features/Context/MockSpContext.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/OpenConext/EngineBlockFunctionalTestingBundle/Features/Context/MockSpContext.php b/src/OpenConext/EngineBlockFunctionalTestingBundle/Features/Context/MockSpContext.php index ef5fb57cb..e5ab6048f 100644 --- a/src/OpenConext/EngineBlockFunctionalTestingBundle/Features/Context/MockSpContext.php +++ b/src/OpenConext/EngineBlockFunctionalTestingBundle/Features/Context/MockSpContext.php @@ -188,7 +188,7 @@ public function spSignsItSRequests($spName) } /** - * @Given /^SP "([^"]*)" is set with acs location "([^"]*)"$/ + * @Given /^SP "([^"]*)" is set with ACS location "([^"]*)"$/ */ public function spConfiguredWithAcsLocation($spName, $acsLocation) {