[cpp-sp] branch main updated: Relax requirement for AccessControl wrapper element.
Scott Cantor
cantor.2 at osu.edu
Wed Oct 29 13:58:24 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
https://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=e6e6c68f2fce42c044f9f2107a1d108e43772a7c
The following commit(s) were added to refs/heads/main by this push:
new e6e6c68f Relax requirement for AccessControl wrapper element.
e6e6c68f is described below
commit e6e6c68f2fce42c044f9f2107a1d108e43772a7c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 29 09:58:19 2025 -0400
Relax requirement for AccessControl wrapper element.
---
shibsp/impl/XMLAccessControl.cpp | 10 +++++-----
shibsp/util/ReloadableXMLFile.cpp | 20 ++++++++++++--------
shibsp/util/ReloadableXMLFile.h | 11 +++++++----
tests/data/impl/acl/inline-ac-acl.xml | 2 --
tests/data/impl/acl/inline-attr-acl.xml | 2 --
tests/data/impl/acl/inline-new-time-invalid.xml | 4 +---
tests/data/impl/acl/inline-new-time-valid.xml | 4 +---
tests/data/impl/acl/inline-not-multiple-acl.xml | 2 --
tests/data/impl/acl/inline-old-time-invalid.xml | 4 +---
tests/data/impl/acl/inline-old-time-valid.xml | 4 +---
tests/data/impl/acl/inline-timesinceauth.xml | 2 --
tests/data/impl/acl/inline-user-acl.xml | 2 --
tests/data/impl/acl/inline-user-regex-acl.xml | 2 --
tests/data/impl/acl/inline-valid-user-acl.xml | 2 --
tests/data/impl/acl/inline-year-invalid.xml | 4 +---
tests/data/impl/acl/inline-year-valid.xml | 5 +----
tests/data/impl/acl/or-acl.xml | 10 ++++------
17 files changed, 34 insertions(+), 56 deletions(-)
diff --git a/shibsp/impl/XMLAccessControl.cpp b/shibsp/impl/XMLAccessControl.cpp
index 5beabf12..1da5bc2a 100644
--- a/shibsp/impl/XMLAccessControl.cpp
+++ b/shibsp/impl/XMLAccessControl.cpp
@@ -153,8 +153,8 @@ namespace {
class XMLAccessControl : public AccessControl, public ReloadableXMLFile
{
public:
- XMLAccessControl(ptree& pt)
- : ReloadableXMLFile(ACCESS_CONTROL_PROP_PATH, pt, Category::getInstance(SHIBSP_LOGCAT ".AccessControl.XML")) {
+ // Does no enforcement of "root" of XML.
+ XMLAccessControl(ptree& pt) : ReloadableXMLFile("", pt, Category::getInstance(SHIBSP_LOGCAT ".AccessControl.XML")) {
if (!load().second) {
throw ConfigurationException("Initial AccessControl configuration was invalid.");
}
@@ -444,7 +444,7 @@ AccessControl::aclresult_t TimeRule::authorized(const SPRequest& request, const
else if (val.islong()) {
operand = val.longinteger();
}
-
+
if (operand > 0) {
if (time(nullptr) - operand <= m_value) {
return shib_acl_true;
@@ -624,9 +624,9 @@ pair<bool,ptree*> XMLAccessControl::load() noexcept
unique_ptr<AccessControl> authz;
// We have to skip the <xmlattr> node if it appears.
- // In the inline case, there should be a child element named
+ // In the inline case, there MAY be a child element named
// AccessControl so we need to step down one level (and again
- // skip the <xmlattr> node.
+ // skip the <xmlattr> node).
for (const auto& child : *raw.second) {
if (child.first == "<xmlattr>") {
diff --git a/shibsp/util/ReloadableXMLFile.cpp b/shibsp/util/ReloadableXMLFile.cpp
index e810c9d1..27c1374c 100644
--- a/shibsp/util/ReloadableXMLFile.cpp
+++ b/shibsp/util/ReloadableXMLFile.cpp
@@ -127,10 +127,12 @@ pair<bool,ptree*> ReloadableXMLFile::load() noexcept
try {
if (m_source.empty()) {
m_log.debug("loading inline configuration...");
- // Data comes from the tree we were handed by locating a subtree of the expected name.
- const boost::optional<const ptree&> child = m_root.get_child_optional(m_rootElementName);
- if (!child) {
- throw xml_parser_error("XML missing expected child element: " + m_rootElementName, "inline", 0);
+ // Optional enforcement of root element as a subtree.
+ if (!m_rootElementName.empty()) {
+ const boost::optional<const ptree&> child = m_root.get_child_optional(m_rootElementName);
+ if (!child) {
+ throw xml_parser_error("XML missing expected child element: " + m_rootElementName, "inline", 0);
+ }
}
// The const_cast is safe because the flag is false,
// preventing the caller from retaining ownership.
@@ -140,10 +142,12 @@ pair<bool,ptree*> ReloadableXMLFile::load() noexcept
unique_ptr<ptree> newtree = unique_ptr<ptree>(new ptree());
xml_parser::read_xml(m_source, *newtree, xml_parser::no_comments|xml_parser::trim_whitespace);
- // Data comes from the tree we were handed by locating a subtree of the expected name.
- const boost::optional<ptree&> child = newtree->get_child_optional(m_rootElementName);
- if (!child) {
- throw xml_parser_error("XML missing expected child element: " + m_rootElementName, m_source, 0);
+ // Optional enforcement of root element as a subtree.
+ if (!m_rootElementName.empty()) {
+ const boost::optional<ptree&> child = newtree->get_child_optional(m_rootElementName);
+ if (!child) {
+ throw xml_parser_error("XML missing expected child element: " + m_rootElementName, m_source, 0);
+ }
}
return make_pair(true, newtree.release());
diff --git a/shibsp/util/ReloadableXMLFile.h b/shibsp/util/ReloadableXMLFile.h
index 39cd72f2..a810416c 100644
--- a/shibsp/util/ReloadableXMLFile.h
+++ b/shibsp/util/ReloadableXMLFile.h
@@ -77,19 +77,22 @@ namespace shibsp {
*
* <p>In the absence of a "path" key, the configuration is assumed to be
* inline as the content of the supplied tree and the base class essentially
- * performs no activity, stubs out locking, etc.</p>
+ * performs no activity, and stubs out locking, etc.</p>
*
- * <p>Note that the root element name specified applies to the content of the
+ * <p>Note that the root element name (if non-empty) applies to the content of the
* configuration itself and not the element that may be carrying the "path" key
* specifying an external file (i.e., in that case it's the external content whose
* root element would be expected to match).</p>
*
* @param pt root of property tree defining resource
- * @param rootElementName name of expexcted root element of XML configuration
+ * @param rootElementName name of expexcted root element of XML configuration or empty string
* @param log logging object to use
*/
ReloadableXMLFile(const std::string& rootElementName, boost::property_tree::ptree& pt, Category& log);
-
+
+ /**
+ * Destructor.
+ */
virtual ~ReloadableXMLFile();
/**
diff --git a/tests/data/impl/acl/inline-ac-acl.xml b/tests/data/impl/acl/inline-ac-acl.xml
index bf26bc25..707382e9 100644
--- a/tests/data/impl/acl/inline-ac-acl.xml
+++ b/tests/data/impl/acl/inline-ac-acl.xml
@@ -1,5 +1,3 @@
<AccessControlProvider type="XML">
- <AccessControl>
<Rule require="authnContextClassRef">urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</Rule>
- </AccessControl>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-attr-acl.xml b/tests/data/impl/acl/inline-attr-acl.xml
index 6b22d0ce..5357b3b3 100644
--- a/tests/data/impl/acl/inline-attr-acl.xml
+++ b/tests/data/impl/acl/inline-attr-acl.xml
@@ -1,5 +1,3 @@
<AccessControlProvider type="XML">
- <AccessControl>
<Rule require="affiliation" list="true">member student</Rule>
- </AccessControl>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-new-time-invalid.xml b/tests/data/impl/acl/inline-new-time-invalid.xml
index 3e569149..de05ed0c 100644
--- a/tests/data/impl/acl/inline-new-time-invalid.xml
+++ b/tests/data/impl/acl/inline-new-time-invalid.xml
@@ -1,5 +1,3 @@
<AccessControlProvider type="XML">
- <AccessControl>
- <Time>GT 3000-01-22T03:00:00Z</Time>
- </AccessControl>
+ <Time>GT 3000-01-22T03:00:00Z</Time>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-new-time-valid.xml b/tests/data/impl/acl/inline-new-time-valid.xml
index 21d23c4b..6583fc13 100644
--- a/tests/data/impl/acl/inline-new-time-valid.xml
+++ b/tests/data/impl/acl/inline-new-time-valid.xml
@@ -1,6 +1,4 @@
<AccessControlProvider type="XML">
- <AccessControl>
- <Time>LE 3000-01-22T03:00:00Z</Time>
- </AccessControl>
+ <Time>LE 3000-01-22T03:00:00Z</Time>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-not-multiple-acl.xml b/tests/data/impl/acl/inline-not-multiple-acl.xml
index 29e04464..61593176 100644
--- a/tests/data/impl/acl/inline-not-multiple-acl.xml
+++ b/tests/data/impl/acl/inline-not-multiple-acl.xml
@@ -1,8 +1,6 @@
<AccessControlProvider type="XML">
- <AccessControl>
<NOT>
<Rule require="authnContextClassRef">urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</Rule>
<Rule require="valid-user" />
</NOT>
- </AccessControl>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-old-time-invalid.xml b/tests/data/impl/acl/inline-old-time-invalid.xml
index b8e68eb2..66d4affc 100644
--- a/tests/data/impl/acl/inline-old-time-invalid.xml
+++ b/tests/data/impl/acl/inline-old-time-invalid.xml
@@ -1,6 +1,4 @@
<AccessControlProvider type="XML">
- <AccessControl>
- <Time>LE 2025-01-22T03:00:00Z</Time>
- </AccessControl>
+ <Time>LE 2025-01-22T03:00:00Z</Time>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-old-time-valid.xml b/tests/data/impl/acl/inline-old-time-valid.xml
index 12ee9967..9b184904 100644
--- a/tests/data/impl/acl/inline-old-time-valid.xml
+++ b/tests/data/impl/acl/inline-old-time-valid.xml
@@ -1,6 +1,4 @@
<AccessControlProvider type="XML">
- <AccessControl>
- <Time>GT 2025-01-22T03:00:00Z</Time>
- </AccessControl>
+ <Time>GT 2025-01-22T03:00:00Z</Time>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-timesinceauth.xml b/tests/data/impl/acl/inline-timesinceauth.xml
index f0952116..062be657 100644
--- a/tests/data/impl/acl/inline-timesinceauth.xml
+++ b/tests/data/impl/acl/inline-timesinceauth.xml
@@ -1,5 +1,3 @@
<AccessControlProvider type="XML">
- <AccessControl>
<TimeSinceAuthn>PT1H</TimeSinceAuthn>
- </AccessControl>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-user-acl.xml b/tests/data/impl/acl/inline-user-acl.xml
index a146b2dc..7d096c93 100644
--- a/tests/data/impl/acl/inline-user-acl.xml
+++ b/tests/data/impl/acl/inline-user-acl.xml
@@ -1,5 +1,3 @@
<AccessControlProvider type="XML">
- <AccessControl>
<Rule require="user">jdoe</Rule>
- </AccessControl>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-user-regex-acl.xml b/tests/data/impl/acl/inline-user-regex-acl.xml
index 02b31603..84f6681d 100644
--- a/tests/data/impl/acl/inline-user-regex-acl.xml
+++ b/tests/data/impl/acl/inline-user-regex-acl.xml
@@ -1,5 +1,3 @@
<AccessControlProvider type="XML">
- <AccessControl>
<RuleRegex require="user">jd.*</Rule>
- </AccessControl>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-valid-user-acl.xml b/tests/data/impl/acl/inline-valid-user-acl.xml
index 952abec6..306a4949 100644
--- a/tests/data/impl/acl/inline-valid-user-acl.xml
+++ b/tests/data/impl/acl/inline-valid-user-acl.xml
@@ -1,5 +1,3 @@
<AccessControlProvider type="XML">
- <AccessControl>
<Rule require="valid-user" />
- </AccessControl>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-year-invalid.xml b/tests/data/impl/acl/inline-year-invalid.xml
index fd4f1098..153147ff 100644
--- a/tests/data/impl/acl/inline-year-invalid.xml
+++ b/tests/data/impl/acl/inline-year-invalid.xml
@@ -1,6 +1,4 @@
<AccessControlProvider type="XML">
- <AccessControl>
- <Year>LT 2000</Year>
- </AccessControl>
+ <Year>LT 2000</Year>
</AccessControlProvider>
diff --git a/tests/data/impl/acl/inline-year-valid.xml b/tests/data/impl/acl/inline-year-valid.xml
index fe5f7a2f..9b6c0fce 100644
--- a/tests/data/impl/acl/inline-year-valid.xml
+++ b/tests/data/impl/acl/inline-year-valid.xml
@@ -1,6 +1,3 @@
<AccessControlProvider type="XML">
- <AccessControl>
- <Year>LT 3000</Year>
- </AccessControl>
+ <Year>LT 3000</Year>
</AccessControlProvider>
-
diff --git a/tests/data/impl/acl/or-acl.xml b/tests/data/impl/acl/or-acl.xml
index 0f398b8d..0b13e508 100644
--- a/tests/data/impl/acl/or-acl.xml
+++ b/tests/data/impl/acl/or-acl.xml
@@ -1,6 +1,4 @@
-<AccessControl>
- <OR>
- <Rule require="user">jdoe</Rule>
- <Rule require="affiliation">student</Rule>
- </OR>
-</AccessControl>
+<OR>
+ <Rule require="user">jdoe</Rule>
+ <Rule require="affiliation">student</Rule>
+</OR>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list