[cpp-sp] branch main updated: SSPCPP-898 - Using an attributePrefix of "HTTP_" should be guarded

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=474d534d6f9ead0b5dcaed77d7916a2c427806a8

The following commit(s) were added to refs/heads/main by this push:
       new  474d534d  SSPCPP-898 - Using an attributePrefix of "HTTP_" should be guarded
474d534d is described below

commit 474d534d6f9ead0b5dcaed77d7916a2c427806a8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Dec 1 13:38:18 2020 -0500

    SSPCPP-898 - Using an attributePrefix of "HTTP_" should be guarded
    
    https://issues.shibboleth.net/jira/browse/SSPCPP-898
---
 shibsp/impl/XMLApplication.cpp | 12 ++++++++++--
 shibsp/impl/XMLApplication.h   |  2 +-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/shibsp/impl/XMLApplication.cpp b/shibsp/impl/XMLApplication.cpp
index 1111980b..0b7c92ed 100644
--- a/shibsp/impl/XMLApplication.cpp
+++ b/shibsp/impl/XMLApplication.cpp
@@ -207,7 +207,7 @@ XMLApplication::XMLApplication(
         m_hash += (DIGITS[0x0F & *ch]);
     }
 
-    doAttributeInfo();
+    doAttributeInfo(log);
 
     if (conf.isEnabled(SPConfig::Handlers))
         doHandlers(pp, e, log);
@@ -398,12 +398,20 @@ template <class T> T* XMLApplication::doChainedPlugins(
     return nullptr;
 }
 
-void XMLApplication::doAttributeInfo()
+void XMLApplication::doAttributeInfo(Category& log)
 {
     // Populate prefix pair.
     m_attributePrefix.second = "HTTP_";
     pair<bool,const char*> prefix = getString("attributePrefix");
     if (prefix.first) {
+#ifdef HAVE_STRCASECMP
+        if (!strcasecmp(prefix.second, "HTTP_")) {
+#else
+        if (!stricmp(prefix.second, "HTTP_")) {
+#endif
+            log.warn("an attributePrefix of HTTP_ allows header smuggling and is unsafe; this will stop working in a future version");
+        }
+
         m_attributePrefix.first = prefix.second;
         const char* pch = prefix.second;
         while (*pch) {
diff --git a/shibsp/impl/XMLApplication.h b/shibsp/impl/XMLApplication.h
index 89afec3f..28d0c047 100644
--- a/shibsp/impl/XMLApplication.h
+++ b/shibsp/impl/XMLApplication.h
@@ -161,7 +161,7 @@ namespace shibsp {
             xmltooling::logging::Category& log,
             const char* dummyType = nullptr
         );
-        void doAttributeInfo();
+        void doAttributeInfo(xmltooling::logging::Category&);
         void doHandlers(const ProtocolProvider*, const xercesc::DOMElement*, xmltooling::logging::Category&);
         void doSSO(const ProtocolProvider&, std::set<std::string>&, xercesc::DOMElement*, xmltooling::logging::Category&);
         void doLogout(const ProtocolProvider&, std::set<std::string>&, xercesc::DOMElement*, xmltooling::logging::Category&);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.