Summary:

The code changes in this pull request focus on improving the date/time parsing and filtering functionality in the DataUtil class, as well as modifying the access control permissions for the PatchRequest schema.

The changes to the DataUtil class enhance the getIso8601Date() method to handle a wider range of date/time formats more robustly, and the createDateFilter() method has been updated to better handle date-only filters. These improvements help ensure the reliable and secure handling of date/time data, which is crucial for preventing potential security vulnerabilities.

The changes to the PatchRequest schema, however, raise some security concerns. Allowing admin users to edit a resource they cannot view could potentially lead to privilege escalation vulnerabilities, which would violate the principle of least privilege. Additionally, it is important to ensure that any changes made to the resource, especially by privileged users, are properly logged and audited to detect and investigate any unauthorized or malicious activities.

Files Changed:

1. jans-config-api/shared/src/main/java/io/jans/configapi/core/util/DataUtil.java:

   • The getIso8601Date() method has been enhanced to handle a wider range of date/time formats, including various ISO 8601 formats.
   • The createDateFilter() method has been updated to better handle date-only filters, creating an AND filter that checks for the date range from the start of the day to the end of the day.
   • The getIso8601Date() method now throws an InvalidAttributeException if the input date/time string does not match the expected formats.

2. jans-config-api/docs/jans-config-api-swagger.yaml:

   • The adminCanEdit property in the PatchRequest schema is being changed to true.
   • The adminCanView property in the PatchRequest schema is being changed to false.
   • This change could potentially lead to privilege escalation vulnerabilities and violate the principle of least privilege. It is important to ensure that proper logging and auditing mechanisms are in place to detect and investigate any unauthorized or malicious activities.