upgraded to spring boot 4.1.0

Encode the redirect target before interpolating it into the authenticator URL

skills-client-integration/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.16</version>
+        <version>4.1.0</version>
         <relativePath/> <!-- lookup parent from repository -->
     </parent>
     <groupId>skills</groupId>
@@ -31,10 +31,6 @@
     <properties>
         <!--suppress UnresolvedMavenProperty -->
         <nexusServer>${nexus.url}</nexusServer>
-        <frontend-maven-plugin.version>1.10.3</frontend-maven-plugin.version>
-
-        <!--  TODO: Temporary override spring boot versions, remove once spring boot upgrades these versions -->
-        <commons-lang3.version>3.19.0</commons-lang3.version>
     </properties>
 
 </project>

skills-client-integration/skills-int-client-js/package.json

@@ -17,7 +17,7 @@
     "author": "SkillTree Team",
     "dependencies": {
         "@skilltree/skills-client-js": "3.6.3",
-        "axios": "1.17.0",
+        "axios": "1.18.0",
         "bootstrap": "5.3.8",
         "jquery": "4.0.0"
     },

skills-client-integration/skills-int-service/pom.xml

@@ -23,6 +23,10 @@
 			<groupId>org.apache.httpcomponents.client5</groupId>
 			<artifactId>httpclient5</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-restclient</artifactId>
+		</dependency>
 	</dependencies>
 
 	<build>

skills-client-integration/skills-int-service/src/main/java/skills/example/Controller.java

@@ -15,10 +15,8 @@
  */
 package skills.example;
 
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.web.client.RestTemplateBuilder;
+import org.springframework.boot.restclient.RestTemplateBuilder;
 import org.springframework.http.*;
 import org.springframework.http.client.support.BasicAuthenticationInterceptor;
 import org.springframework.util.LinkedMultiValueMap;
@@ -27,6 +25,8 @@ import org.springframework.util.StringUtils;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.client.RestTemplate;
 import skills.example.SkillsExampleApplication.SkillsConfig;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
 
 import java.util.ArrayList;
 import java.util.Arrays;

skills-client-integration/skills-int-service/src/main/java/skills/example/SecurityRestTemplateCustomizer.java

@@ -23,11 +23,9 @@ import org.apache.hc.client5.http.socket.PlainConnectionSocketFactory;
 import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
 import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
 import org.apache.hc.core5.http.config.RegistryBuilder;
-import org.apache.hc.core5.ssl.SSLContextBuilder;
 import org.apache.hc.core5.ssl.SSLContexts;
-import org.apache.hc.core5.ssl.TrustStrategy;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.web.client.RestTemplateCustomizer;
+import org.springframework.boot.restclient.RestTemplateCustomizer;
 import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
 import org.springframework.stereotype.Component;
 import org.springframework.web.client.RestTemplate;

skills-client-integration/skills-int-service/src/main/java/skills/example/filters/VueEntryPointFilter.java

@@ -18,15 +18,18 @@ package skills.example.filters;
 import jakarta.servlet.*;
 import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.security.SecurityProperties;
 import org.springframework.core.annotation.Order;
 import org.springframework.stereotype.Component;
 
 import java.io.IOException;
 
 @Component
-@Order(SecurityProperties.DEFAULT_FILTER_ORDER-1)
+@Order(VueEntryPointFilter.BEFORE_SECURITY_FILTER_ORDER)
 public class VueEntryPointFilter implements Filter {
+
+    // -100 (Default Security Order) - 1
+    public static final int BEFORE_SECURITY_FILTER_ORDER = -101;
+
     @Autowired
     private VueEntryPointFilterUtils vueEntryPointFilterUtils;
 

skills-client-js/package.json

@@ -30,7 +30,7 @@
     "author": "SkillTree Team",
     "devDependencies": {
         "@babel/cli": "7.28.6",
-        "@babel/core": "7.29.0",
+        "@babel/core": "7.29.6",
         "@babel/plugin-transform-runtime": "7.29.0",
         "@babel/polyfill": "7.12.1",
         "@babel/preset-env": "7.29.5",
@@ -56,7 +56,7 @@
     },
     "dependencies": {
         "@stomp/stompjs": "7.3.0",
-        "axios": "1.17.0",
+        "axios": "1.18.0",
         "js-logger": "1.6.1",
         "postmate": "1.5.2",
         "sockjs-client": "1.6.1"

skills-client-js/src/SkillsService.js

@@ -119,7 +119,7 @@ export default {
           if (xhr.status !== 200) {
             if (isOAuthMode && oauthRedirect && xhr.status === 401) {
               // if we get 401 and we are using OAuth, then redirect to the OAuth Provider
-              const oauthAuthenticator = `${authenticator}?skillsRedirectUri=${window.location}`;
+              const oauthAuthenticator = `${authenticator}?skillsRedirectUri=${encodeURIComponent(window.location.href)}`;
               log.info(`SkillsClient::SkillService::unable to get oAuth token, navigating to [${oauthAuthenticator}]`);
               this.assignWindowLocation(oauthAuthenticator);
               resolve();

skills-client-js/test/SkillsService.test.js

@@ -45,7 +45,23 @@ describe('OAuth auto redirect tests', () => {
     await SkillsService.getAuthenticationToken(authEndpoint, mockServiceUrl, mockProjectId, true);
 
     expect(SkillsService.assignWindowLocation).toHaveBeenCalledTimes(1)
-    expect(SkillsService.assignWindowLocation).toHaveBeenCalledWith(`${authEndpoint}?skillsRedirectUri=http://localhost/`)
+    expect(SkillsService.assignWindowLocation).toHaveBeenCalledWith(`${authEndpoint}?skillsRedirectUri=${encodeURIComponent('http://localhost/')}`)
+  });
+
+  it('oauth redirect encodes the current location so it cannot add query parameters', async () => {
+    const oauthTokenEndpoint = `${mockServiceUrl}/api/projects/${mockProjectId}/token`;
+    mock.get(oauthTokenEndpoint, (req, res) => res.status(401));
+
+    window.history.pushState({}, '', '/page?a=1&skillsRedirectUri=http://evil.example.com/');
+    const injected = window.location.href;
+
+    await SkillsService.getAuthenticationToken(authEndpoint, mockServiceUrl, mockProjectId, true);
+
+    const [redirectedTo] = SkillsService.assignWindowLocation.mock.calls[0];
+    expect(redirectedTo).toBe(`${authEndpoint}?skillsRedirectUri=${encodeURIComponent(injected)}`);
+    // the injected separators must not survive as separators
+    expect(redirectedTo.split('?')).toHaveLength(2);
+    expect(redirectedTo).not.toContain('&skillsRedirectUri=');
   });
 
   it('oauth does not auto redirect when oauthRedirect=false', async () => {