[cpp-sp] 02/02: Move URL sanitizing back into TokenConsumer.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository cpp-sp.

View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/e7938db7178f21d512466591d99f2b3b63e093db

commit e7938db7178f21d512466591d99f2b3b63e093db
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 4 17:14:49 2025 -0500

    Move URL sanitizing back into TokenConsumer.
---
 shibsp/handler/impl/TokenConsumer.cpp | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/shibsp/handler/impl/TokenConsumer.cpp b/shibsp/handler/impl/TokenConsumer.cpp
index df1d0153..c4f7a6d2 100644
--- a/shibsp/handler/impl/TokenConsumer.cpp
+++ b/shibsp/handler/impl/TokenConsumer.cpp
@@ -124,8 +124,12 @@ pair<bool,long> TokenConsumer::run(SPRequest& request, bool isHandler) const
         }
 
         // If target is still empty, then this is a POST recovery attempt with the reesource
-        // buried in the form action.
-        
+        // buried in the form action. Assuming it's non-empty, we must sanitize it.
+        // TODO: we have to have some way to sanitize it anyway...
+        if (!target.empty()) {
+            request.limitRedirect(target.c_str());
+            request.absolutize(target);
+        }
 
         SessionCache* cache = request.getAgent().getSessionCache();
         DDF sessionData = output["session"];

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.