wso2 / product-is

Welcome to the WSO2 Identity Server source code! For info on working with the WSO2 Identity Server repository and contributing code, click the link below.
http://wso2.github.io/
Apache License 2.0
748 stars 728 forks source link

Add proper validation for locale attribute value #21554

Open Yoshani opened 2 weeks ago

Yoshani commented 2 weeks ago

Is your suggestion related to an experience ? Please describe. Currently we can set any value as the locale attribute through the SCIM APIs. Owing to this, the issue https://github.com/wso2-enterprise/wso2-iam-internal/issues/2527 was raised because some invalid locale values resulted in issues at the backend when parsing. This specific error occurred when parsing the locale value through Java's Locale.forLanguageTag() which returns empty strings for some invalid locale values like en*US, en-US@ and ... This empty string later causes the backend to throw a server exception. But for invalid locales like alex it returns the same string, causing that to be switched to the default locale later on. Thus, it is important to find a proper validation method to allow users to only set a proper valid locale value such as en-US.

Describe the improvement Above locale validation, once finalized, can be engaged via a pre-listener when adding or updating a user. But we need to consider the migration impact for existing invalid locale values that have been set.

sadilchamishka commented 1 day ago

The locale can be update as follows.

curl 'https://localhost:9443/t/carbon.super/scim2/Me' \
  -X 'PATCH' \
  -H 'Authorization: Bearer bdfb45e3-9ea0-3fc2-9591-0385032b8963' \
  -H 'Referer;' \
  -H 'Accept: application/json, text/plain, */*' \
  -H 'Content-Type: application/json' \
  --data-raw '{"Operations":[{"op":"replace","value":{"locale":"en-US"}}],"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"]}' \
  --insecure

Need to add backend validation for the locale pass in the request body.

[1] - https://github.com/wso2-extensions/identity-inbound-provisioning-scim2/blob/master/components/org.wso2.carbon.identity.scim2.provider/src/main/java/org/wso2/carbon/identity/scim2/provider/resources/MeResource.java#L204