<commit_before>/*
 * Copyright 2006-2007 Sxip Identity Corporation
 */

package org.openid4java.server;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.discovery.Discovery;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.discovery.yadis.YadisResolver;

import java.util.List;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.regex.Pattern;
import java.net.URL;
import java.net.MalformedURLException;

/**
 * @author <NAME>, <NAME>
 */
public class RealmVerifier
{
    private static Log _log = LogFactory.getLog(RealmVerifier.class);
    private static final boolean DEBUG = _log.isDebugEnabled();

    public static final int OK = 0;
    public static final int DENIED_REALM = 1;
    public static final int MALFORMED_REALM = 2;
    public static final int MALFORMED_RETURN_TO_URL = 3;
    public static final int FRAGMENT_NOT_ALLOWED = 4;
    public static final int PROTOCOL_MISMATCH = 5;
    public static final int PORT_MISMATCH = 6;
    public static final int PATH_MISMATCH = 7;
    public static final int DOMAIN_MISMATCH = 8;
    public static final int RP_DISCOVERY_FAILED = 9;
    public static final int RP_INVALID_ENDPOINT = 10;

    private List _deniedRealmDomains;
    private List _deniedRealmRegExps;

    // yadis resolver used for RP discovery
    private YadisResolver _yadisResolver;

    private boolean _enforceRpId;

    public RealmVerifier()
    {
        _deniedRealmDomains = new ArrayList();

        addDeniedRealmDomain("\\*\\.[^\\.]+");
        addDeniedRealmDomain("\\*\\.[a-z]{2}\\.[a-z]{2}");

        _yadisResolver = new YadisResolver();

        _enforceRpId = true;
    }

    public void addDeniedRealmDomain(String deniedRealmDomain)
    {
        _deniedRealmDomains.add(deniedRealmDomain);

        compileDeniedRealms();
    }

    public List getDeniedRealmDomains()
    {
        return _deniedRealmDomains;
    }

    public void setDeniedRealmDomains(List deniedRealmDomains)
    {
        _deniedRealmDomains = deniedRealmDomains;

        compileDeniedRealms();
    }

    private void compileDeniedRealms()
    {
        _deniedRealmRegExps = new ArrayList(_deniedRealmDomains.size());

        for (int i = 0; i < _deniedRealmDomains.size(); i++)
        {
            String deniedRealm = (String) _deniedRealmDomains.get(i);

            Pattern deniedRealmPattern =
                Pattern.compile(deniedRealm, Pattern.CASE_INSENSITIVE);

            _deniedRealmRegExps.add(deniedRealmPattern);
        }
    }


    public boolean getEnforceRpId()
    {
        return _enforceRpId;
    }

    public void setEnforceRpId(boolean enforceRpId)
    {
        this._enforceRpId = enforceRpId;
    }

    public int validate(String realm, String returnTo)
    {
        return validate(realm, returnTo, _enforceRpId);
    }

    public int validate(String realm, String returnTo, boolean enforceRpId)
    {
        int result;
        // 1. match the return_to against the realm
        result = match(realm, returnTo);

        if (OK != result)
        {
            _log.error("Return URL: " + returnTo +
                       " does not match realm: " + realm);
            return result;
        }

        // 2. match the return_to against RP endpoints discovered from the realm
        result = RP_INVALID_ENDPOINT; // assume there won't get a match
        try
        {
            // replace '*.' with 'www.' in the authority part
            URL realmUrl = new URL(realm);
            if (realmUrl.getAuthority().startsWith("*."))
                realm = realm.replaceFirst("\\*\\.", "www.");

            List endpoints = Discovery.rpDiscovery(realm, _yadisResolver);
            DiscoveryInformation endpoint;
            String endpointUrl;
            Iterator iter = endpoints.iterator();
            while (iter.hasNext())
            {
                endpoint = (DiscoveryInformation) iter.next();
                endpointUrl = endpoint.getOPEndpoint().toString();

                if (endpoint.getOPEndpoint().getAuthority().startsWith("*."))
                {
                    _log.warn("Wildcard not allowed in discovered " +
                              "RP endpoints; found: " + endpointUrl);
                    continue;
                }

                if (OK == match(endpointUrl, returnTo))
                {
                    _log.info("Return URL: " + returnTo +
                             " matched discovered RP endpoint: " + endpointUrl);
                    result = OK;
                    break;
                }
            }
        }
        catch (DiscoveryException e)
        {
            _log.error("Discovery failed on realm: " + realm, e);
            result = RP_DISCOVERY_FAILED;
        }
        catch (MalformedURLException e)
        {
            _log.error("Invalid realm URL: " + realm, e);
            result = MALFORMED_REALM;
        }

        // return the result
        if (enforceRpId)
        {
            return result;
        }
        else
        {
            if (OK != result)
                _log.warn("Failed to validate return URL: " + returnTo +
                    " against endpoints discovered from the RP's realm; " +
                    "not enforced, returning OK; error code: " + result);
            return OK;
        }
    }

    public int match(String realm, String returnTo)
    {<commit_msg>Setting the appropriate log level for failed RP realm discovery, based on the configured preference (enforced : error / not enforced : warn).<commit_after>/*
 * Copyright 2006-2007 Sxip Identity Corporation
 */

package org.openid4java.server;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.openid4java.discovery.Discovery;
import org.openid4java.discovery.DiscoveryException;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.discovery.yadis.YadisResolver;

import java.util.List;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.regex.Pattern;
import java.net.URL;
import java.net.MalformedURLException;

/**
 * @author <NAME>, <NAME>
 */
public class RealmVerifier
{
    private static Log _log = LogFactory.getLog(RealmVerifier.class);
    private static final boolean DEBUG = _log.isDebugEnabled();

    public static final int OK = 0;
    public static final int DENIED_REALM = 1;
    public static final int MALFORMED_REALM = 2;
    public static final int MALFORMED_RETURN_TO_URL = 3;
    public static final int FRAGMENT_NOT_ALLOWED = 4;
    public static final int PROTOCOL_MISMATCH = 5;
    public static final int PORT_MISMATCH = 6;
    public static final int PATH_MISMATCH = 7;
    public static final int DOMAIN_MISMATCH = 8;
    public static final int RP_DISCOVERY_FAILED = 9;
    public static final int RP_INVALID_ENDPOINT = 10;

    private List _deniedRealmDomains;
    private List _deniedRealmRegExps;

    // yadis resolver used for RP discovery
    private YadisResolver _yadisResolver;

    private boolean _enforceRpId;

    public RealmVerifier()
    {
        _deniedRealmDomains = new ArrayList();

        addDeniedRealmDomain("\\*\\.[^\\.]+");
        addDeniedRealmDomain("\\*\\.[a-z]{2}\\.[a-z]{2}");

        _yadisResolver = new YadisResolver();

        _enforceRpId = true;
    }

    public void addDeniedRealmDomain(String deniedRealmDomain)
    {
        _deniedRealmDomains.add(deniedRealmDomain);

        compileDeniedRealms();
    }

    public List getDeniedRealmDomains()
    {
        return _deniedRealmDomains;
    }

    public void setDeniedRealmDomains(List deniedRealmDomains)
    {
        _deniedRealmDomains = deniedRealmDomains;

        compileDeniedRealms();
    }

    private void compileDeniedRealms()
    {
        _deniedRealmRegExps = new ArrayList(_deniedRealmDomains.size());

        for (int i = 0; i < _deniedRealmDomains.size(); i++)
        {
            String deniedRealm = (String) _deniedRealmDomains.get(i);

            Pattern deniedRealmPattern =
                Pattern.compile(deniedRealm, Pattern.CASE_INSENSITIVE);

            _deniedRealmRegExps.add(deniedRealmPattern);
        }
    }


    public boolean getEnforceRpId()
    {
        return _enforceRpId;
    }

    public void setEnforceRpId(boolean enforceRpId)
    {
        this._enforceRpId = enforceRpId;
    }

    public int validate(String realm, String returnTo)
    {
        return validate(realm, returnTo, _enforceRpId);
    }

    public int validate(String realm, String returnTo, boolean enforceRpId)
    {
        int result;
        // 1. match the return_to against the realm
        result = match(realm, returnTo);

        if (OK != result)
        {
            _log.error("Return URL: " + returnTo +
                       " does not match realm: " + realm);
            return result;
        }

        // 2. match the return_to against RP endpoints discovered from the realm
        result = RP_INVALID_ENDPOINT; // assume there won't get a match
        try
        {
            // replace '*.' with 'www.' in the authority part
            URL realmUrl = new URL(realm);
            if (realmUrl.getAuthority().startsWith("*."))
                realm = realm.replaceFirst("\\*\\.", "www.");

            List endpoints = Discovery.rpDiscovery(realm, _yadisResolver);
            DiscoveryInformation endpoint;
            String endpointUrl;
            Iterator iter = endpoints.iterator();
            while (iter.hasNext())
            {
                endpoint = (DiscoveryInformation) iter.next();
                endpointUrl = endpoint.getOPEndpoint().toString();

                if (endpoint.getOPEndpoint().getAuthority().startsWith("*."))
                {
                    _log.warn("Wildcard not allowed in discovered " +
                              "RP endpoints; found: " + endpointUrl);
                    continue;
                }

                if (OK == match(endpointUrl, returnTo))
                {
                    _log.info("Return URL: " + returnTo +
                             " matched discovered RP endpoint: " + endpointUrl);
                    result = OK;
                    break;
                }
            }
        }
        catch (DiscoveryException e)
        {
            if (_enforceRpId)
                _log.error("Discovery failed on realm: " + realm, e);
            else
                _log.warn("Discovery failed on realm: " + realm, e);
            
            result = RP_DISCOVERY_FAILED;
        }
        catch (MalformedURLException e)
        {
            _log.error("Invalid realm URL: " + realm, e);
            result = MALFORMED_REALM;
        }

        // return the result
        if (enforceRpId)
        {
            return result;
        }
        else
        {
            if (OK != result)
                _log.warn("Failed to validate return URL: " + returnTo +
                    " against endpoints discovered from the RP's realm; " +
                    "not enforced, returning OK; error code: " + result);
            return OK;
        }
    }

    public int match(String realm, String returnTo)
    {
{'fraction_non_alphanumeric': 0.0901762777925414, 'fraction_numerical': 0.005314908317831517, 'mean_word_length': 2.018716577540107, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3216999', 'n_tokens_mistral': 3361, 'n_tokens_neox': 3156, 'n_words': 788}