[cpp-sp COMMIT] in /branches/REL_2: schemas/shibboleth-2.0-native-sp-config.xsd shibsp/impl/XMLSecurityPolicyProvider...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Jul 31 00:02:17 2012
New Revision: 3741

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3741&view=rev
Log:
https://issues.shibboleth.net/jira/browse/SSPCPP-486

Modified:
    branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd
    branches/REL_2/shibsp/impl/XMLSecurityPolicyProvider.cpp
    branches/REL_2/shibsp/impl/XMLServiceProvider.cpp
    branches/REL_2/shibsp/security/SecurityPolicyProvider.h

Modified: branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd?rev=3741&r1=3740&r2=3741&view=diff
==============================================================================
--- branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd (original)
+++ branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd Tue Jul 31 00:02:17 2012
@@ -710,7 +710,15 @@
         </element>
         <choice minOccurs="0">
           <element name="AlgorithmWhitelist" type="conf:listOfURIs"/>
-          <element name="AlgorithmBlacklist" type="conf:listOfURIs"/>
+          <element name="AlgorithmBlacklist">
+            <complexType>
+              <simpleContent>
+                <extension base="conf:listOfURIs">
+                  <attribute name="includeDefaultBlacklist" type="boolean"/>
+                </extension>
+              </simpleContent>
+            </complexType>
+          </element>
         </choice>
       </sequence>
     </complexType>

Modified: branches/REL_2/shibsp/impl/XMLSecurityPolicyProvider.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/impl/XMLSecurityPolicyProvider.cpp?rev=3741&r1=3740&r2=3741&view=diff
==============================================================================
--- branches/REL_2/shibsp/impl/XMLSecurityPolicyProvider.cpp (original)
+++ branches/REL_2/shibsp/impl/XMLSecurityPolicyProvider.cpp Tue Jul 31 00:02:17 2012
@@ -62,7 +62,7 @@
     class SHIBSP_DLLLOCAL XMLSecurityPolicyProviderImpl
     {
     public:
-        XMLSecurityPolicyProviderImpl(const DOMElement* e, Category& log);
+        XMLSecurityPolicyProviderImpl(const DOMElement*, Category&);
         ~XMLSecurityPolicyProviderImpl() {
             if (m_document)
                 m_document->release();
@@ -74,6 +74,7 @@
 
     private:
         DOMDocument* m_document;
+        bool m_includeDefaultBlacklist;
         vector<xstring> m_whitelist,m_blacklist;
         vector< boost::shared_ptr<SecurityPolicyRule> > m_ruleJanitor;   // need this to maintain vector type in API
         typedef map< string,pair< boost::shared_ptr<PropertySet>,vector<const SecurityPolicyRule*> > > policymap_t;
@@ -112,6 +113,9 @@
                 return i->second.second;
             throw ConfigurationException("Security Policy ($1) not found, check <SecurityPolicies> element.", params(1,id));
         }
+        const vector<xstring>& getDefaultAlgorithmBlacklist() const {
+            return m_impl->m_includeDefaultBlacklist ? m_defaultBlacklist : m_empty;
+        }
         const vector<xstring>& getAlgorithmBlacklist() const {
             return m_impl->m_blacklist;
         }
@@ -125,6 +129,7 @@
 
     private:
         scoped_ptr<XMLSecurityPolicyProviderImpl> m_impl;
+        static vector<xstring> m_empty;
     };
 
 #if defined (_MSC_VER)
@@ -151,6 +156,7 @@
 
     static const XMLCh _id[] =                  UNICODE_LITERAL_2(i,d);
     static const XMLCh _type[] =                UNICODE_LITERAL_4(t,y,p,e);
+    static const XMLCh includeDefaultBlacklist[] = UNICODE_LITERAL_23(i,n,c,l,u,d,e,D,e,f,a,u,l,t,B,l,a,c,k,l,i,s,t);
     static const XMLCh AlgorithmBlacklist[] =   UNICODE_LITERAL_18(A,l,g,o,r,i,t,h,m,B,l,a,c,k,l,i,s,t);
     static const XMLCh AlgorithmWhitelist[] =   UNICODE_LITERAL_18(A,l,g,o,r,i,t,h,m,W,h,i,t,e,l,i,s,t);
     static const XMLCh Policy[] =               UNICODE_LITERAL_6(P,o,l,i,c,y);
@@ -166,10 +172,18 @@
 
 SecurityPolicyProvider::SecurityPolicyProvider()
 {
+    m_defaultBlacklist.push_back(DSIGConstants::s_unicodeStrURIRSA_MD5);
+    m_defaultBlacklist.push_back(DSIGConstants::s_unicodeStrURIMD5);
+    m_defaultBlacklist.push_back(DSIGConstants::s_unicodeStrURIRSA_1_5);
 }
 
 SecurityPolicyProvider::~SecurityPolicyProvider()
 {
+}
+
+const vector<xstring>& SecurityPolicyProvider::getDefaultAlgorithmBlacklist() const
+{
+    return m_defaultBlacklist;
 }
 
 SecurityPolicy* SecurityPolicyProvider::createSecurityPolicy(
@@ -181,7 +195,7 @@
 }
 
 XMLSecurityPolicyProviderImpl::XMLSecurityPolicyProviderImpl(const DOMElement* e, Category& log)
-    : m_document(nullptr), m_defaultPolicy(m_policyMap.end())
+    : m_document(nullptr), m_includeDefaultBlacklist(true), m_defaultPolicy(m_policyMap.end())
 {
 #ifdef _DEBUG
     xmltooling::NDC ndc("XMLSecurityPolicyProviderImpl");
@@ -192,11 +206,15 @@
 
     const XMLCh* algs = nullptr;
     const DOMElement* alglist = XMLHelper::getLastChildElement(e, AlgorithmBlacklist);
-    if (alglist && alglist->hasChildNodes()) {
-        algs = alglist->getFirstChild()->getNodeValue();
+    if (alglist) {

[... 101 lines stripped ...]