[JIRA] Closed: (SSPCPP-487) relayStateLimitWhitelist parameter is being changed inadvertently by limitRelayState method

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor closed SSPCPP-487.
-------------------------------


> relayStateLimitWhitelist parameter is being changed inadvertently by limitRelayState method
> -------------------------------------------------------------------------------------------
>
>                 Key: SSPCPP-487
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-487
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>    Affects Versions: 2.4.2
>            Reporter: njjones at idp.protectnetwork.org
>            Assignee: Scott Cantor
>              Labels: RelayState
>             Fix For: 2.5
>
>         Attachments: shibboleth-2_4_2-AbstractHandler_cpp(whitelist).patch
>
>
> The relayStateWhitelist parameter is being modified by strtok in the method limitRelayState.  Subsequent calls to limitRelayState then fail to match on anything other than the first URL configured in the relayStateWhitelist parameter.  
> This problem can be identified by using the relayStateLimit 'whitelist' option and providing multiple URLs in the relayStateWhitelist parameter.
> Attached is a patch of the fix.  It copies the original white list parameter value, and passes the copy to strtok.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira