Skip to content

Commit 9d4413f

Browse files
authored
Securing handling added for webapps with webcp flight, Fixes AB#3344894 (#2733)
In this PR #2732, I added a new check to detect device CA flow and follow our current pattern of handling the device CA requests. But I did not secure it with a flight. There are 2 ways of adding a flight for this 1. Add a new flight that is independent of webcp feature 2. Depend on webcp feature only. I went with 2nd option, because I only really need these changes when webcp flight is ON so that users are not blocked by new flow. So, I am securing it with webcp flight. Fixes [AB#3344894](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3344894)
1 parent 760b740 commit 9d4413f

File tree

2 files changed

+24
-1
lines changed

2 files changed

+24
-1
lines changed

common/src/main/java/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -343,7 +343,7 @@ else if (isRedirectUrl(formattedURL)) {
343343
processWebCpEnrollmentUrl(view, url);
344344
} else if (mIsWebCpInWebViewFeatureEnabled && isWebCpAuthorizeUrl(url)) {
345345
processWebCpAuthorize(view, url);
346-
} else if (isDeviceCaRequest(url) && isHttpsScheme(url)) {
346+
} else if (isDeviceCaRequest(url) && isHttpsScheme(url) && isWebCpInWebviewFeatureEnabled(url)) {
347347
// Special handling for device CA requests due to a corner case in eSTS for webapps/confidential clients, which should be handled by the WebView.
348348
processDeviceCaRequest(view, url);
349349
} else {

common/src/test/java/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClientTest.java

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,8 +173,31 @@ public void testUrlOverrideHandlesWebsiteRequestUrl() {
173173
}
174174

175175
@Test
176+
@Config(shadows = {
177+
ShadowProcessUtil.class})
176178
public void testUrlOverrideHandlesHttpsDeviceCARequestUrl() {
179+
final IFlightsProvider mockFlightsProvider = Mockito.mock(IFlightsProvider.class);
180+
when(mockFlightsProvider.isFlightEnabled(CommonFlight.ENABLE_WEB_CP_IN_WEBVIEW)).thenReturn(true);
181+
182+
final MockCommonFlightsManager mockCommonFlightsManager = new MockCommonFlightsManager();
183+
mockCommonFlightsManager.setMockCommonFlightsProvider(mockFlightsProvider);
184+
CommonFlightsManager.INSTANCE.initializeCommonFlightsManager(mockCommonFlightsManager);
177185
assertTrue(mWebViewClient.shouldOverrideUrlLoading(mMockWebView, TEST_HTTPS_DEVICE_CA_URL_QUERY_STRING_PARAMETER));
186+
CommonFlightsManager.INSTANCE.resetFlightsManager();
187+
}
188+
189+
@Test
190+
@Config(shadows = {
191+
ShadowProcessUtil.class})
192+
public void testUrlHandlesHttpsDeviceCARequestUrlFlightOff() {
193+
final IFlightsProvider mockFlightsProvider = Mockito.mock(IFlightsProvider.class);
194+
when(mockFlightsProvider.isFlightEnabled(CommonFlight.ENABLE_WEB_CP_IN_WEBVIEW)).thenReturn(false);
195+
196+
final MockCommonFlightsManager mockCommonFlightsManager = new MockCommonFlightsManager();
197+
mockCommonFlightsManager.setMockCommonFlightsProvider(mockFlightsProvider);
198+
CommonFlightsManager.INSTANCE.initializeCommonFlightsManager(mockCommonFlightsManager);
199+
assertFalse(mWebViewClient.shouldOverrideUrlLoading(mMockWebView, TEST_HTTPS_DEVICE_CA_URL_QUERY_STRING_PARAMETER));
200+
CommonFlightsManager.INSTANCE.resetFlightsManager();
178201
}
179202

180203
@Test

0 commit comments

Comments
 (0)