[cpp-sp COMMIT] /branches/REL_2/shibsp/impl/XMLServiceProvider.cpp

[noreply at shibboleth.net]

Author: scantor
Date: Tue Feb  3 14:39:19 2015
New Revision: 3904

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3904&view=rev
Log:
SSPCPP-613 - add warning if no semi-colon found

Modified:
    branches/REL_2/shibsp/impl/XMLServiceProvider.cpp

Modified: branches/REL_2/shibsp/impl/XMLServiceProvider.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/impl/XMLServiceProvider.cpp?rev=3904&r1=3903&r2=3904&view=diff
==============================================================================
--- branches/REL_2/shibsp/impl/XMLServiceProvider.cpp (original)
+++ branches/REL_2/shibsp/impl/XMLServiceProvider.cpp Tue Feb  3 14:39:19 2015
@@ -594,10 +594,15 @@
             log.warn("insecure cookieProps setting, set to \"https\" for SSL/TLS-only usage");
         }
         else if (strcmp(prop.second, "https")) {
-            if (!strstr(prop.second, ";secure") && !strstr(prop.second, "; secure"))
+            if (!strstr(prop.second, "secure"))
                 log.warn("custom cookieProps setting should include \"; secure\" for SSL/TLS-only usage");
-            else if (!strstr(prop.second, ";HttpOnly") && !strstr(prop.second, "; HttpOnly"))
+            else if (!strstr(prop.second, "HttpOnly"))
                 log.warn("custom cookieProps setting should include \"; HttpOnly\", site is vulnerable to client-side cookie theft");
+
+            while (*prop.second && isspace(*prop.second))
+                ++prop.second;
+            if (*prop.second != ';')
+                log.warn("custom cookieProps setting must begin with a semicolon (;) as a delimiter");
         }
 
         pair<bool,bool> handlerSSL = sessionProps->getBool("handlerSSL");