[ALS-4981] Validate fence code is alphanumeric

hms-dbmi · Sep 14, 2023 · 67cf41e · 67cf41e
1 parent f791134
commit 67cf41e
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/...main/java/edu/harvard/hms/dbmi/avillach/auth/service/auth/FENCEAuthenticationService.java b/...main/java/edu/harvard/hms/dbmi/avillach/auth/service/auth/FENCEAuthenticationService.java
@@ -157,6 +157,12 @@ public Response getFENCEProfile(String callback_url, Map<String, String> authReq
         logger.debug("getFENCEProfile() starting...");
         String fence_code  = authRequest.get("code");
 
+        // Validate that the fence code is alphanumeric
+        if (!fence_code.matches("[a-zA-Z0-9]+")) {
+            logger.error("getFENCEProfile() fence code is not alphanumeric");
+            throw new NotAuthorizedException("The fence code is not alphanumeric");
+        }
+
         JsonNode fence_user_profile = null;
         // Get the Gen3/FENCE user profile. It is a JsonNode object
         try {