[cpp-sp] branch master updated: Shortcut processing for handler

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch master
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=b3178cd5d60426c01979414b92ee594e0e79deef

The following commit(s) were added to refs/heads/master by this push:
       new  b3178cd   Shortcut processing for handler
b3178cd is described below

commit b3178cd5d60426c01979414b92ee594e0e79deef
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon May 28 13:22:21 2018 +0100

    Shortcut processing for handler
    
    At the top of filter processing, before and Shibboleth code gets
    invoked, check the url path against the prefix specified by
    
    <ISAPI handlerPrefix="..." >
    
    default value "/Shibboleth.sso".  If it isn't an exact
    prefix bail.
    
    Wildcarding can be achieved by setting tthis to "/" (because all
    paths start with a "/".
---
 iis7_shib/ShibHttpModule.cpp                | 17 ++++++++++++++---
 iis7_shib/headers/IIS7_shib.hpp             |  3 ++-
 iis7_shib/register.cpp                      |  9 +++++++--
 schemas/shibboleth-3.0-native-sp-config.xsd |  1 +
 4 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/iis7_shib/ShibHttpModule.cpp b/iis7_shib/ShibHttpModule.cpp
index 281d0eb..45bdb97 100644
--- a/iis7_shib/ShibHttpModule.cpp
+++ b/iis7_shib/ShibHttpModule.cpp
@@ -20,14 +20,18 @@
 
 #include "IIS7_shib.hpp"
 
-#include <process.h>
-
 #include <xmltooling/util/NDC.h>
 
 #include "ShibHttpModule.hpp"
 #include "IIS7Request.hpp"
 
+#include <process.h>
+#include <winreg.h>
+
+#include <boost/algorithm/string.hpp>
+
 using namespace Config;
+using namespace std;
 
 REQUEST_NOTIFICATION_STATUS
 ShibHttpModule::DoHandler(
@@ -35,6 +39,14 @@ ShibHttpModule::DoHandler(
     _In_ IHttpEventProvider *   pProvider
 )
 {
+    // Quickly check the URL
+    const wstring url(pHttpContext->GetScriptName());
+    if (url.length() < g_handlerPrefix.length())
+        return RQ_NOTIFICATION_CONTINUE;
+
+    const wstring cmp(url.substr(0, g_handlerPrefix.length()));
+    if (cmp != g_handlerPrefix)
+        return RQ_NOTIFICATION_CONTINUE;
 
     map<string,site_t>::const_iterator map_i = g_Sites.find(lexical_cast<string>(pHttpContext->GetSite()->GetSiteId()));
     if (map_i == g_Sites.end())
@@ -116,4 +128,3 @@ ShibHttpModule::OnAuthenticateRequest(
 {
     return DoFilter(pHttpContext, pProvider);
 }
-
diff --git a/iis7_shib/headers/IIS7_shib.hpp b/iis7_shib/headers/IIS7_shib.hpp
index 2dfd6de..b9d19be 100644
--- a/iis7_shib/headers/IIS7_shib.hpp
+++ b/iis7_shib/headers/IIS7_shib.hpp
@@ -68,6 +68,7 @@ namespace Config {
     static const XMLCh id[] =               UNICODE_LITERAL_2(i, d);
     static const XMLCh useHeaders[] =       UNICODE_LITERAL_10(u, s, e, H, e, a, d, e, r, s);
     static const XMLCh useVariables[] =     UNICODE_LITERAL_12(u, s, e, V, a, r, i, a, b, l, e, s);
+    static const XMLCh handlerPrefix[] =    UNICODE_LITERAL_13(h, a, n, d, l, e, r, P, r, e, f, i, x);
     static const XMLCh Alias[] =            UNICODE_LITERAL_5(A, l, i, a, s);
     static const XMLCh Site[] =             UNICODE_LITERAL_4(S, i, t, e);
     static const XMLCh Role[] =             UNICODE_LITERAL_4(R, o, l, e);
@@ -84,7 +85,7 @@ namespace Config {
     extern bool g_bUseHeaders;
     extern bool g_bUseVariables;
     extern vector<string> g_NoCerts;
-
+    extern wstring g_handlerPrefix;
 
     struct site_t {
         site_t(const DOMElement* e)
diff --git a/iis7_shib/register.cpp b/iis7_shib/register.cpp
index 6431dab..be2729c 100644
--- a/iis7_shib/register.cpp
+++ b/iis7_shib/register.cpp
@@ -43,6 +43,7 @@ namespace Config {
     bool g_catchAll = false;
     bool g_bSafeHeaderNames = false;
     bool g_bUseHeaders = false;
+    wstring g_handlerPrefix(L"");
     bool g_bUseVariables = true;
     vector<string> g_NoCerts;
     vector<string> g_RoleAttributeNames;
@@ -65,7 +66,8 @@ static void _my_invalid_parameter_handler(
 
 class ShibModuleFactory : public IHttpModuleFactory {
 public:
-    ShibModuleFactory() {};
+    ShibModuleFactory() {
+    };
     virtual HRESULT GetHttpModule(
         CHttpModule **  ppModule,
         _In_ IModuleAllocator *     pAllocator
@@ -167,6 +169,10 @@ RegisterModule(
             flag = props->getBool("useVariables");
             g_bUseVariables= !flag.first || flag.second;
 
+            const string prefix(XMLHelper::getAttrString(props->getElement(), "/Shibboleth.sso", handlerPrefix));
+            std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> converter;
+            g_handlerPrefix = converter.from_bytes(prefix);
+
             const DOMElement* site = XMLHelper::getFirstChildElement(props->getElement(), Site);
             while (site) {
                 string id(XMLHelper::getAttrString(site, "", id));
@@ -179,7 +185,6 @@ RegisterModule(
                 const pair<bool, const char*> authNRoleFlag = roles->getString("authNRole");
 
                 if (authNRoleFlag.first) {
-                    std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> converter;
                     wstring rolestr(converter.from_bytes(string(authNRoleFlag.second)));
 
                     g_authNRole = rolestr;
diff --git a/schemas/shibboleth-3.0-native-sp-config.xsd b/schemas/shibboleth-3.0-native-sp-config.xsd
index 79a237a..fa403e2 100644
--- a/schemas/shibboleth-3.0-native-sp-config.xsd
+++ b/schemas/shibboleth-3.0-native-sp-config.xsd
@@ -205,6 +205,7 @@
           <attribute name="safeHeaderNames" type="boolean"/>
           <attribute name="useHeaders" type="boolean"/>
           <attribute name="useVariables" type="boolean"/>
+          <attribute name="handlerPrefix" type="conf:string" use="optional"/>
           <anyAttribute namespace="##other" processContents="lax"/>
         </complexType>
       </element>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.