CVE-2024-11734

@@ -19,6 +19,7 @@
 import jakarta.ws.rs.BadRequestException;
 import org.jboss.logging.Logger;
 
+import java.util.Map;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -29,7 +30,7 @@
  */
 public class ReservedCharValidator {
     protected static final Logger logger = Logger.getLogger(ReservedCharValidator.class);
-    
+
     // https://tools.ietf.org/html/rfc3986#section-2.2
     private static final Pattern RESERVED_CHARS_PATTERN = Pattern.compile("[:/?#@!$&()*+,;=\\[\\]\\\\]");
 
@@ -38,32 +39,28 @@ public class ReservedCharValidator {
 
     private ReservedCharValidator() {}
 
-    public static void validate(String str, Pattern pattern) throws ReservedCharException {
+    public static void validate(String str, Pattern pattern) {
+        validate(str, pattern, null);
+    }
+
+    public static void validate(String str, Pattern pattern, String message) throws ReservedCharException {
         if (str == null) return;
 
         Matcher matcher = pattern.matcher(str);
         if (matcher.find()) {
-            String message = "Character '" + matcher.group() + "' not allowed.";
+            if(message == null) {
+                message = "Character '" + matcher.group() + "' not allowed.";
+            }
             logger.warn(message);
             throw new ReservedCharException(message);
         }
     }
-    
+
     public static void validateNoSpace(String str) {
-        if (str == null) return;
-        
-        Pattern pattern = Pattern.compile("\\s");
-        Matcher matcher = pattern.matcher(str);
-        
-        if (matcher.find()) {
-            String message = "Empty Space not allowed.";
-            logger.warn(message);
-            throw new ReservedCharException(message);
-        }
-        
+        validate(str, Pattern.compile("\\s"), "Empty Space not allowed.");
         validate(str, RESERVED_CHARS_PATTERN);
     }
-    
+
     public static void validate(String str) {
         validate(str, RESERVED_CHARS_PATTERN);
     }
@@ -75,7 +72,16 @@ public static void validateLocales(Iterable<String> strIterable) {
             validate(str, RESERVED_CHARS_LOCALES_PATTERN);
         }
     }
-    
+
+    public static void validateSecurityHeaders(Map<String, String> headers) {
+        if (headers == null) return;
+
+        for (Map.Entry<String, String> entry : headers.entrySet()) {
+            validate(entry.getKey(), Pattern.compile("\\n"), "Newline not allowed.");
+            validate(entry.getValue(), Pattern.compile("\\n"), "Newline not allowed.");
+        }
+    }
+
     public static class ReservedCharException extends BadRequestException {
         ReservedCharException(String msg) {
             super(msg);

@@ -536,6 +536,7 @@ public RealmModel importRealm(RealmRepresentation rep, boolean skipUserDependent
             session.getContext().setRealm(realm);
             ReservedCharValidator.validate(rep.getRealm());
             ReservedCharValidator.validateLocales(rep.getSupportedLocales());
+            ReservedCharValidator.validateSecurityHeaders(rep.getBrowserSecurityHeaders());
             realm.setName(rep.getRealm());
 
             // setup defaults

@@ -418,8 +418,14 @@ public Response updateRealm(final RealmRepresentation rep) {
             throw ErrorResponse.error("Can't rename master realm", Status.BAD_REQUEST);
         }
 
-        ReservedCharValidator.validate(rep.getRealm());
-        ReservedCharValidator.validateLocales(rep.getSupportedLocales());
+        try {
+            ReservedCharValidator.validate(rep.getRealm());
+            ReservedCharValidator.validateLocales(rep.getSupportedLocales());
+            ReservedCharValidator.validateSecurityHeaders(rep.getBrowserSecurityHeaders());
+        } catch (ReservedCharValidator.ReservedCharException e) {
+            logger.error(e.getMessage(), e);
+            throw ErrorResponse.error(e.getMessage(), Status.BAD_REQUEST);
+        }
 
         try {
             if (!Constants.GENERATE.equals(rep.getPublicKey()) && (rep.getPrivateKey() != null && rep.getPublicKey() != null)) {

@@ -17,6 +17,7 @@
 
 package org.keycloak.testsuite.oauth;
 
+import jakarta.ws.rs.BadRequestException;
 import org.apache.commons.io.IOUtils;
 import org.apache.http.Header;
 import org.apache.http.NameValuePair;
@@ -35,6 +36,7 @@
 import org.keycloak.models.BrowserSecurityHeaders;
 import org.keycloak.models.Constants;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ErrorRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.ActionURIUtils;
@@ -57,6 +59,7 @@
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
@@ -219,6 +222,20 @@ public void checkEmptyCsp() throws Exception {
         }
     }
 
+    @Test
+    public void checkCspWithNewline() throws Exception {
+        try {
+            new RealmAttributeUpdater(adminClient.realm("test"))
+                    .setBrowserSecurityHeader(BrowserSecurityHeaders.CONTENT_SECURITY_POLICY.getKey(), "test\ntest")
+                    .update();
+            fail("Validation should fail due to newline");
+        }
+        catch (BadRequestException ex) {
+            ErrorRepresentation errorRep = ex.getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("Newline not allowed.", errorRep.getErrorMessage());
+        }
+    }
+
     @Override
     public void addTestRealms(List<RealmRepresentation> testRealms) {
         testRealms.add(RealmBuilder.create().name("test").build());