[cpp-sp COMMIT] in /branches/REL_2/shibsp/handler: Handler.h impl/AbstractHandler.cpp impl/SAML2LogoutInitiator.cpp i...

[noreply at shibboleth.net]

Author: scantor
Date: Thu May  3 17:32:16 2012
New Revision: 3638

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3638&view=rev
Log:
https://issues.shibboleth.net/jira/browse/SSPCPP-444

Modified:
    branches/REL_2/shibsp/handler/Handler.h
    branches/REL_2/shibsp/handler/impl/AbstractHandler.cpp
    branches/REL_2/shibsp/handler/impl/SAML2LogoutInitiator.cpp
    branches/REL_2/shibsp/handler/impl/SessionInitiator.cpp

Modified: branches/REL_2/shibsp/handler/Handler.h
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/handler/Handler.h?rev=3638&r1=3637&r2=3638&view=diff
==============================================================================
--- branches/REL_2/shibsp/handler/Handler.h (original)
+++ branches/REL_2/shibsp/handler/Handler.h Thu May  3 17:32:16 2012
@@ -61,6 +61,20 @@
          * @param msg   message to log
          */
         virtual void log(SPRequest::SPLogLevel level, const std::string& msg) const;
+
+        /**
+         * Prevents unused relay state from building up by cleaning old state from the client.
+         *
+         * <p>Handlers that generate relay state should call this method as a house cleaning
+         * step.
+         *
+         * @param application   the associated Application
+         * @param request       incoming HTTP request
+         * @param response      outgoing HTTP response
+         */
+        virtual void cleanRelayState(
+            const Application& application, const xmltooling::HTTPRequest& request, xmltooling::HTTPResponse& response
+            ) const;
 
         /**
          * Implements various mechanisms to preserve RelayState,

Modified: branches/REL_2/shibsp/handler/impl/AbstractHandler.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/handler/impl/AbstractHandler.cpp?rev=3638&r1=3637&r2=3638&view=diff
==============================================================================
--- branches/REL_2/shibsp/handler/impl/AbstractHandler.cpp (original)
+++ branches/REL_2/shibsp/handler/impl/AbstractHandler.cpp Thu May  3 17:32:16 2012
@@ -177,6 +177,54 @@
         );
 }
 
+void Handler::cleanRelayState(
+    const Application& application, const xmltooling::HTTPRequest& request, xmltooling::HTTPResponse& response
+    ) const
+{
+    // Only cookie-based relay state requires cleaning.
+    pair<bool,const char*> mech = getString("relayState");
+    if (!mech.first) {
+        // Check for setting on Sessions element.
+        const PropertySet* sessionprop = application.getPropertySet("Sessions");
+        if (sessionprop)
+            mech = sessionprop->getString("relayState");
+    }
+    if (!mech.first || !mech.second || strncmp(mech.second, "cookie", 6))
+        return;
+    
+    int maxCookies = 25,purgedCookies = 0;
+    mech.second += 6;
+    if (*mech.second == ':' && isdigit(*(++mech.second))) {
+        maxCookies = atoi(mech.second);
+        if (maxCookies == 0)
+            maxCookies = 25;
+    }
+
+    string exp;
+
+    // Walk the list of cookies backwards by name.
+    const map<string,string>& cookies = request.getCookies();
+    for (map<string,string>::const_reverse_iterator i = cookies.rbegin(); i != cookies.rend(); ++i) {
+        // Process relay state cookies only.
+        if (starts_with(i->first, "_shibstate_")) {
+            if (maxCookies > 0) {
+                // Keep it, but count it against the limit.
+                --maxCookies;
+            }
+            else {
+                // We're over the limit, so everything here and older gets cleaned up.
+                if (exp.empty())
+                    exp = string(application.getCookieNameProps("_shibstate_").second) + "; expires=Mon, 01 Jan 2001 00:00:00 GMT";
+                response.setCookie(i->first.c_str(), exp.c_str());
+                ++purgedCookies;
+            }
+        }
+    }
+
+    if (purgedCookies > 0)
+        log(SPRequest::SPDebug, string("purged ") + lexical_cast<string>(purgedCookies) + " stale relay state cookie(s) from client");
+}
+
 void Handler::preserveRelayState(const Application& application, HTTPResponse& response, string& relayState) const
 {
     // The empty string implies no state to deal with.
@@ -194,22 +242,22 @@
     if (!mech.first || !mech.second || !*mech.second)
         return;
 
-    if (!strcmp(mech.second, "cookie")) {
+    if (!strncmp(mech.second, "cookie", 6)) {
         // Here we store the state in a cookie and send a fixed
         // value so we can recognize it on the way back.
         if (relayState.find("cookie:") != 0) {
-            const URLEncoder* urlenc = XMLToolingConfig::getConfig().getURLEncoder();
-            pair<string,const char*> shib_cookie=application.getCookieNameProps("_shibstate_");
-            string stateval = urlenc->encode(relayState.c_str()) + shib_cookie.second;
+            pair<string,const char*> shib_cookie = application.getCookieNameProps("_shibstate_");
+            string stateval = XMLToolingConfig::getConfig().getURLEncoder()->encode(relayState.c_str()) + shib_cookie.second;

[... 67 lines stripped ...]