[cpp-sp] branch main updated: Split the difference, and the URL checking.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository cpp-sp.

View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/d8c582c90bddb22467008d6f93e3919bf97c5608

The following commit(s) were added to refs/heads/main by this push:
     new d8c582c9 Split the difference, and the URL checking.
d8c582c9 is described below

commit d8c582c90bddb22467008d6f93e3919bf97c5608
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 4 17:19:53 2025 -0500

    Split the difference, and the URL checking.
---
 shibsp/handler/impl/AbstractHandler.cpp | 4 +++-
 shibsp/handler/impl/TokenConsumer.cpp   | 1 -
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/shibsp/handler/impl/AbstractHandler.cpp b/shibsp/handler/impl/AbstractHandler.cpp
index 3a57d2b7..b38d9746 100644
--- a/shibsp/handler/impl/AbstractHandler.cpp
+++ b/shibsp/handler/impl/AbstractHandler.cpp
@@ -180,7 +180,9 @@ pair<bool,long> AbstractHandler::unwrapResponse(SPRequest& request, DDF& wrapped
 
     h = http["redirect"];
     if (h.isstring()) {
-        return make_pair(true, request.sendRedirect(h.string()));
+        string dest(h.string());
+        request.absolutize(dest);
+        return make_pair(true, request.sendRedirect(dest.c_str()));
     }
 
     h = http["response"];
diff --git a/shibsp/handler/impl/TokenConsumer.cpp b/shibsp/handler/impl/TokenConsumer.cpp
index c4f7a6d2..f708f83c 100644
--- a/shibsp/handler/impl/TokenConsumer.cpp
+++ b/shibsp/handler/impl/TokenConsumer.cpp
@@ -128,7 +128,6 @@ pair<bool,long> TokenConsumer::run(SPRequest& request, bool isHandler) const
         // TODO: we have to have some way to sanitize it anyway...
         if (!target.empty()) {
             request.limitRedirect(target.c_str());
-            request.absolutize(target);
         }
 
         SessionCache* cache = request.getAgent().getSessionCache();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.