[cpp-sp] branch master updated: SSPCPP-851 - Limit the number of _shibpost cookies

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=7aef006d757caede8fc399c9d44fb673a9adcc49

The following commit(s) were added to refs/heads/master by this push:
       new  7aef006   SSPCPP-851 - Limit the number of _shibpost cookies
7aef006 is described below

commit 7aef006d757caede8fc399c9d44fb673a9adcc49
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Mar 7 12:34:52 2019 -0500

    SSPCPP-851 - Limit the number of _shibpost cookies
    
    https://issues.shibboleth.net/jira/browse/SSPCPP-851
---
 shibsp/handler/impl/AbstractHandler.cpp | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/shibsp/handler/impl/AbstractHandler.cpp b/shibsp/handler/impl/AbstractHandler.cpp
index e808957..56c2959 100644
--- a/shibsp/handler/impl/AbstractHandler.cpp
+++ b/shibsp/handler/impl/AbstractHandler.cpp
@@ -646,8 +646,35 @@ void AbstractHandler::preservePostData(
             postkey = string(mech.second-3) + ':' + out.string();
         }
 
-        // Set a cookie with key info.
         pair<string,const char*> shib_cookie = getPostCookieNameProps(application, relayState);
+
+        // Purge any cookies in excess of 25.
+        int maxCookies = 25,purgedCookies = 0;
+        string exp;
+
+        // Walk the list of cookies backwards by name.
+        const map<string,string>& cookies = request.getCookies();
+        for (map<string,string>::const_reverse_iterator i = cookies.rbegin(); i != cookies.rend(); ++i) {
+            // Process post data cookies only.
+            if (starts_with(i->first, "_shibpost_")) {
+                if (maxCookies > 0) {
+                    // Keep it, but count it against the limit.
+                    --maxCookies;
+                }
+                else {
+                    // We're over the limit, so everything here and older gets cleaned up.
+                    if (exp.empty())
+                        exp = string(shib_cookie.second) + "; expires=Mon, 01 Jan 2001 00:00:00 GMT";
+                    response.setCookie(i->first.c_str(), exp.c_str());
+                    ++purgedCookies;
+                }
+            }
+        }
+
+        if (purgedCookies > 0)
+            log(SPRequest::SPDebug, string("purged ") + lexical_cast<string>(purgedCookies) + " stale POST preservation cookie(s) from client");
+
+        // Set a cookie with key info.
         postkey += shib_cookie.second;
         response.setCookie(shib_cookie.first.c_str(), postkey.c_str());
     }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.