[java-shib-shared] branch main updated: Add bypass for ServletContext check around setAttribute calls.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-shib-shared.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-shared.git;a=commit;h=c4d7ce862a975d97bb8f590f44026d195944cd8c

The following commit(s) were added to refs/heads/main by this push:
     new c4d7ce86 Add bypass for ServletContext check around setAttribute calls.
c4d7ce86 is described below

commit c4d7ce862a975d97bb8f590f44026d195944cd8c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 10 12:43:05 2025 -0400

    Add bypass for ServletContext check around setAttribute calls.
---
 .../net/shibboleth/shared/net/CookieManager.java   | 26 ++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/shib-networking/src/main/java/net/shibboleth/shared/net/CookieManager.java b/shib-networking/src/main/java/net/shibboleth/shared/net/CookieManager.java
index 6c5b7214..7c7b9e33 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/net/CookieManager.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/net/CookieManager.java
@@ -79,6 +79,9 @@ public class CookieManager extends AbstractInitializableComponent {
     /** Maximum age in seconds, or -1 for session. */
     private int maxAge;
     
+    /** Whether to guard {@link Cookie#setAttribute(String, String)} calls. */
+    private boolean guardSetAttribute;
+    
     /** The allowed same-site cookie attribute values.*/
     public enum SameSiteValue{       
         
@@ -147,6 +150,7 @@ public class CookieManager extends AbstractInitializableComponent {
         sameSiteCondition = PredicateSupport.alwaysTrue();
         cookieAttributes = CollectionSupport.emptyMap();
         cookieLimit = 0;
+        guardSetAttribute = true;
     }
 
     /**
@@ -320,6 +324,20 @@ public class CookieManager extends AbstractInitializableComponent {
             maxAge = -1;
         }
     }
+    
+    /**
+     * Sets whether to guard calls to {@link Cookie#setAttribute(String, String)} with a check for
+     * the container's servlet API version.
+     * 
+     * <p>Defaults to true.</p>
+     * 
+     * @param flag
+     */
+    public void setGuardSetAttribute(final boolean flag) {
+        checkSetterPreconditions();
+        
+        guardSetAttribute = flag;
+    }
 
     /**
      * Gets the SameSite attribute.
@@ -467,7 +485,7 @@ public class CookieManager extends AbstractInitializableComponent {
         super.doInitialize();
         
         if (httpRequestSupplier == null || httpResponseSupplier == null) {
-            throw new ComponentInitializationException("Servlet request and response must be set");
+            throw new ComponentInitializationException("Servlet request and response suppliers must be set");
         }
     }
 
@@ -517,7 +535,7 @@ public class CookieManager extends AbstractInitializableComponent {
         cookie.setSecure(isSecure());
         cookie.setHttpOnly(isHttpOnly());
         cookie.setMaxAge(overrideMaxAge);
-        if (getHttpServletRequest().getServletContext().getMajorVersion() >= 6) {
+        if (!guardSetAttribute || getHttpServletRequest().getServletContext().getMajorVersion() >= 6) {
             attachSameSite(cookie);
             cookieAttributes.forEach((n,v) -> {
                 cookie.setAttribute(n, v);
@@ -553,7 +571,7 @@ public class CookieManager extends AbstractInitializableComponent {
         cookie.setSecure(isSecure());
         cookie.setHttpOnly(isHttpOnly());
         cookie.setMaxAge(0);
-        if (getHttpServletRequest().getServletContext().getMajorVersion() >= 6) {
+        if (!guardSetAttribute || getHttpServletRequest().getServletContext().getMajorVersion() >= 6) {
             attachSameSite(cookie);
             cookieAttributes.forEach((n,v) -> {
                 cookie.setAttribute(n, v);
@@ -631,7 +649,7 @@ public class CookieManager extends AbstractInitializableComponent {
         }
         
         final Cookie[] cookies = getHttpServletRequest().getCookies();
-        if (cookies == null || cookies.length == 0) {
+        if (cookies == null || cookies.length == 0 || cookies.length <= getCookieLimit()) {
             return;
         }
         

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.