[JIRA] Created: (SSPCPP-487) relayStateLimitWhitelist parameter is being changed inadvertently by limitRelayState method

[njjones@idp.protectnetwork.org (JIRA)]

relayStateLimitWhitelist parameter is being changed inadvertently by limitRelayState method
-------------------------------------------------------------------------------------------

                 Key: SSPCPP-487
                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-487
             Project: Shibboleth SP - C++
          Issue Type: Bug
      Security Level: Standard (Standard bug, may impact functionality but does not represent a security vulnerability )
    Affects Versions: 2.4.2
            Reporter: njjones at idp.protectnetwork.org
            Assignee: Scott Cantor
         Attachments: shibboleth-2_4_2-AbstractHandler_cpp(whitelist).patch

The relayStateWhitelist parameter is being modified by strtok in the method limitRelayState.  Subsequent calls to limitRelayState then fail to match on anything other than the first URL configured in the relayStateWhitelist parameter.  

This problem can be identified by using the relayStateLimit 'whitelist' option and providing multiple URLs in the relayStateWhitelist parameter.

Attached is a patch of the fix.  It copies the original white list parameter value, and passes the copy to strtok.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira