[cpp-sp] branch main updated: Expose header/variable usage through API.
Scott Cantor
cantor.2 at osu.edu
Wed Apr 23 18:14:58 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=bc1b3bd158eb11a89c676fd66bc949855d947ad0
The following commit(s) were added to refs/heads/main by this push:
new bc1b3bd1 Expose header/variable usage through API.
bc1b3bd1 is described below
commit bc1b3bd158eb11a89c676fd66bc949855d947ad0
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Apr 23 14:14:54 2025 -0400
Expose header/variable usage through API.
---
apache/mod_shib_24.cpp | 28 +++++++++++++++-------
fastcgi/shibauthorizer.cpp | 6 +++++
fastcgi/shibresponder.cpp | 6 +++++
iis7_shib/IIS7Request.cpp | 18 ++++++++++----
iis7_shib/headers/IIS7Request.hpp | 2 ++
shibsp/SPRequest.h | 20 ++++++++++++++++
.../impl/DefaultAttributeConfiguration.cpp | 6 +++--
7 files changed, 71 insertions(+), 15 deletions(-)
diff --git a/apache/mod_shib_24.cpp b/apache/mod_shib_24.cpp
index 8e192407..1faf27b5 100644
--- a/apache/mod_shib_24.cpp
+++ b/apache/mod_shib_24.cpp
@@ -346,7 +346,7 @@ public:
setRequestURI(m_req->unparsed_uri);
- if (check_user && m_dc->bUseHeaders == 1) {
+ if (check_user && isUseHeaders()) {
// Try and see if this request was already processed, to skip spoof checking.
if (!ap_is_initial_req(m_req)) {
m_firsttime = false;
@@ -362,6 +362,14 @@ public:
return true;
}
+ bool isUseHeaders() const {
+ // Headers only used if turned on.
+ return m_dc->bUseHeaders == 1;
+ }
+ bool isUseVariables() const {
+ // Variables used if not turned off.
+ return m_dc->bUseEnvVars != 0;
+ }
const char* getScheme() const {
return m_sc->szScheme ? m_sc->szScheme : ap_http_scheme(m_req);
}
@@ -452,7 +460,7 @@ public:
return AbstractSPRequest::getParameters(name, values);
}
void clearHeader(const char* rawname, const char* cginame) {
- if (m_dc->bUseHeaders == 1) {
+ if (isUseHeaders()) {
// ap_log_rerror(APLOG_MARK,APLOG_DEBUG|APLOG_NOERRNO,0, m_req, "shib_clear_header: hdr\n");
if (g_checkSpoofing && m_firsttime) {
if (m_allhttp.empty()) {
@@ -480,26 +488,28 @@ public:
}
}
void setHeader(const char* name, const char* value) {
- if (m_dc->bUseEnvVars != 0) {
+ if (isUseVariables()) {
if (!m_rc) {
// this happens on subrequests
// ap_log_rerror(APLOG_MARK,APLOG_DEBUG|APLOG_NOERRNO,0, m_req, "shib_setheader: no_m_rc\n");
m_rc = get_request_config(m_req);
}
- if (!m_rc->env)
- m_rc->env = apr_table_make(m_req->pool, 10);
- // ap_log_rerror(APLOG_MARK,APLOG_DEBUG|APLOG_NOERRNO,0, m_req, "shib_set_env: %s=%s\n", name, value?value:"Null");
+ if (!m_rc->env) {
+ m_rc->env = apr_table_make(m_req->pool, 10);
+ // ap_log_rerror(APLOG_MARK,APLOG_DEBUG|APLOG_NOERRNO,0, m_req, "shib_set_env: %s=%s\n", name, value?value:"Null");
+ }
apr_table_set(m_rc->env, name, value ? value : "");
}
- if (m_dc->bUseHeaders == 1)
+ if (isUseHeaders()) {
apr_table_set(m_req->headers_in, name, value);
+ }
}
string getHeader(const char* name) const {
const char* hdr = apr_table_get(m_req->headers_in, name);
return string(hdr ? hdr : "");
}
string getSecureHeader(const char* name) const {
- if (m_dc->bUseEnvVars != 0) {
+ if (isUseVariables()) {
const char *hdr;
if (m_rc && m_rc->env)
hdr = apr_table_get(m_rc->env, name);
@@ -511,7 +521,7 @@ public:
}
void setRemoteUser(const char* user) {
m_req->user = user ? apr_pstrdup(m_req->pool, user) : nullptr;
- if (m_dc->bUseHeaders == 1) {
+ if (isUseHeaders()) {
if (user) {
apr_table_set(m_req->headers_in, "REMOTE_USER", user);
}
diff --git a/fastcgi/shibauthorizer.cpp b/fastcgi/shibauthorizer.cpp
index 893b0c4c..03b52621 100644
--- a/fastcgi/shibauthorizer.cpp
+++ b/fastcgi/shibauthorizer.cpp
@@ -81,6 +81,12 @@ public:
~ShibTargetFCGIAuth() { }
+ bool isUseHeaders() const {
+ return false;
+ }
+ bool isUseVariables() const {
+ return true;
+ }
const char* getScheme() const {
return m_scheme.c_str();
}
diff --git a/fastcgi/shibresponder.cpp b/fastcgi/shibresponder.cpp
index 25ddaad6..d5a1bd36 100644
--- a/fastcgi/shibresponder.cpp
+++ b/fastcgi/shibresponder.cpp
@@ -82,6 +82,12 @@ public:
~ShibTargetFCGI() { }
+ bool isUseHeaders() const {
+ return false;
+ }
+ bool isUseVariables() const {
+ return true;
+ }
const char* getScheme() const {
return m_scheme.c_str();
}
diff --git a/iis7_shib/IIS7Request.cpp b/iis7_shib/IIS7Request.cpp
index 9b4c990c..f81c95b5 100644
--- a/iis7_shib/IIS7Request.cpp
+++ b/iis7_shib/IIS7Request.cpp
@@ -144,15 +144,25 @@ IIS7Request::IIS7Request(IHttpContext *pHttpContext, IHttpEventProvider *pEventP
}
}
+bool IIS7Request::isUseHeaders() const
+{
+ return m_useHeaders;
+}
+
+bool IIS7Request::isUseVariables() const
+{
+ return m_useVariables;
+}
+
void IIS7Request::setHeader(const char* name, const char* value)
{
- if (m_useHeaders) {
+ if (isUseHeaders()) {
const HRESULT hr (m_request->SetHeader(m_safeHeaderNames ? makeSafeHeader(name).c_str() : name, value, static_cast<USHORT>(strlen(value)), TRUE));
if (FAILED(hr)) {
throwError("setHeader (Header)", hr);
}
}
- if (m_useVariables) {
+ if (isUseVariables()) {
std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> converter;
const wstring wValue(converter.from_bytes(value));
const HRESULT hr(m_ctx->SetServerVariable(const_cast<char*>(name), wValue.c_str()));
@@ -197,7 +207,7 @@ const char* IIS7Request::getMethod() const
void IIS7Request::clearHeader(const char* rawname, const char* cginame)
{
- if (m_useHeaders) {
+ if (isUseHeaders()) {
if (g_checkSpoofing && m_firsttime) {
if (m_allhttp.empty()) {
PCSTR val = nullptr;
@@ -250,7 +260,7 @@ string IIS7Request::getRemoteAddr() const
string IIS7Request::getSecureHeader(const char* name) const
{
- if (m_useVariables) {
+ if (isUseVariables()) {
PCWSTR p;
DWORD len;
HRESULT hr = m_ctx->GetServerVariable(name, &p, &len);
diff --git a/iis7_shib/headers/IIS7Request.hpp b/iis7_shib/headers/IIS7Request.hpp
index deb96573..905f242f 100644
--- a/iis7_shib/headers/IIS7Request.hpp
+++ b/iis7_shib/headers/IIS7Request.hpp
@@ -57,6 +57,8 @@ protected:
//
// AbstractSP
//
+ bool isUseHeaders() const;
+ bool isUseVariables() const;
void setHeader(const char* name, const char* value);
void setRemoteUser(const char* user);
const vector<string>& getClientCertificates() const;
diff --git a/shibsp/SPRequest.h b/shibsp/SPRequest.h
index ca7fdfad..40a62ea4 100644
--- a/shibsp/SPRequest.h
+++ b/shibsp/SPRequest.h
@@ -62,6 +62,26 @@ namespace shibsp {
*/
virtual RequestMapper::Settings getRequestSettings() const=0;
+ /**
+ * Gets a server/vhost/site level determination as to the use of HTTP request headers
+ * for publication of attribute data.
+ *
+ * <p>Headers should never be used now but remain supported for compatibbility and
+ * influence the behavior other system components. If any ambiguiity ever exists as
+ * to the answer, true should be returned.</p>
+ *
+ * @return true iff headers are being used
+ */
+ virtual bool isUseHeaders() const=0;
+
+ /**
+ * Gets a server/vhost/site level determination as to the use of server variables
+ * for publication of attribute data.
+ *
+ * @return true iff varables are being used
+ */
+ virtual bool isUseVariables() const=0;
+
/**
* Returns a locked Session associated with the request.
*
diff --git a/shibsp/attribute/impl/DefaultAttributeConfiguration.cpp b/shibsp/attribute/impl/DefaultAttributeConfiguration.cpp
index 3f5bda15..40b5cfda 100644
--- a/shibsp/attribute/impl/DefaultAttributeConfiguration.cpp
+++ b/shibsp/attribute/impl/DefaultAttributeConfiguration.cpp
@@ -228,8 +228,10 @@ bool DefaultAttributeConfiguration::isCaseSensitive(const char* attributeID) con
void DefaultAttributeConfiguration::clearHeaders(SPRequest& request) const
{
- for (const auto& names : m_mappings) {
- request.clearHeader(names.second.first.c_str(), names.second.second.c_str());
+ if (request.isUseHeaders()) {
+ for (const auto& names : m_mappings) {
+ request.clearHeader(names.second.first.c_str(), names.second.second.c_str());
+ }
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list