[java-plugin-shibd] branch main updated: Trap runtime exception on invalid inbound cookies.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-plugin-shibd.

View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=2d816695e26f212b6cf46eb37288463c1b906453

The following commit(s) were added to refs/heads/main by this push:
     new 2d81669  Trap runtime exception on invalid inbound cookies.
2d81669 is described below

commit 2d816695e26f212b6cf46eb37288463c1b906453
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 17 14:50:32 2025 -0400

    Trap runtime exception on invalid inbound cookies.
---
 .../shibboleth/sp/messaging/RemotedHttpServletRequest.java    | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletRequest.java b/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletRequest.java
index 275e65e..7c62d4a 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletRequest.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletRequest.java
@@ -126,7 +126,7 @@ public class RemotedHttpServletRequest implements HttpServletRequest {
     @Nonnull private final DDF obj;
     
     /** Cookie array. */
-    @Nullable @NonnullElements private List<Cookie> cookies;
+    @NonnullElements private List<Cookie> cookies;
     
     /** Parameter map. */
     @Nullable private Map<String, String[]> parameters;
@@ -410,8 +410,11 @@ public class RemotedHttpServletRequest implements HttpServletRequest {
                         final String[] nvpair = c.split("=", -1);
                         if (nvpair.length == 2) {
                             final String name = nvpair[0].trim();
-                            assert cookies != null;
-                            cookies.add(new Cookie(name, nvpair[1]));
+                            try {
+                                cookies.add(new Cookie(name, nvpair[1]));
+                            } catch (final IllegalArgumentException e) {
+                                // Ignore invalid cookies.
+                            }
                         }
                     }
                 } else {
@@ -422,12 +425,10 @@ public class RemotedHttpServletRequest implements HttpServletRequest {
             }
         }
         
-        assert cookies != null;
         if (cookies.isEmpty()) {
             return null;
         }
         
-        assert cookies != null;
         return cookies.toArray(new Cookie[cookies.size()]);
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.