[cpp-sp] branch main updated: Redesign setResponseHeader API properly.
Codeberg
noreply at shibboleth.net
Fri Jun 5 16:57:15 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository cpp-sp.
View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/f786261bee9fe8b9a78db12aece4c3500add3a8d
The following commit(s) were added to refs/heads/main by this push:
new f786261b Redesign setResponseHeader API properly.
f786261b is described below
commit f786261bee9fe8b9a78db12aece4c3500add3a8d
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Fri Jun 5 12:57:05 2026 -0400
Redesign setResponseHeader API properly.
---
apache/mod_shib4.cpp | 3 +--
fastcgi/shibauthorizer.cpp | 3 +--
fastcgi/shibresponder.cpp | 3 +--
iis/IIS7Request.cpp | 4 +---
iis/headers/IIS7Request.hpp | 4 ++--
shibsp/AbstractSPRequest.cpp | 19 +++++++++++++++++++
shibsp/AbstractSPRequest.h | 13 +++++++++++++
shibsp/io/HTTPResponse.h | 2 +-
shibsp/io/impl/HTTPResponse.cpp | 17 -----------------
tests/DummyRequest.h | 3 +--
10 files changed, 40 insertions(+), 31 deletions(-)
diff --git a/apache/mod_shib4.cpp b/apache/mod_shib4.cpp
index 5e2fd7ba..c23c8fc8 100644
--- a/apache/mod_shib4.cpp
+++ b/apache/mod_shib4.cpp
@@ -455,8 +455,7 @@ public:
void setContentType(const char* type) {
m_req->content_type = apr_psprintf(m_req->pool, "%s", type);
}
- void setResponseHeader(const char* name, const char* value, bool replace=false) {
- HTTPResponse::setResponseHeader(name, value, replace);
+ void doResponseHeader(const char* name, const char* value, bool replace=false) {
if (name && *name) {
#ifdef SHIB_DEFERRED_HEADERS
if (!m_rc) {
diff --git a/fastcgi/shibauthorizer.cpp b/fastcgi/shibauthorizer.cpp
index a6c57c29..74fa6d2a 100644
--- a/fastcgi/shibauthorizer.cpp
+++ b/fastcgi/shibauthorizer.cpp
@@ -188,8 +188,7 @@ public:
}
return "";
}
- void setResponseHeader(const char* name, const char* value, bool replace=false) {
- HTTPResponse::setResponseHeader(name, value, replace);
+ void doResponseHeader(const char* name, const char* value, bool replace=false) {
if (name && *name) {
// Set for later.
if (replace || !value)
diff --git a/fastcgi/shibresponder.cpp b/fastcgi/shibresponder.cpp
index 5fb1bdf5..dc7d4cdd 100644
--- a/fastcgi/shibresponder.cpp
+++ b/fastcgi/shibresponder.cpp
@@ -148,8 +148,7 @@ public:
return s ? s : "";
}
- void setResponseHeader(const char* name, const char* value, bool replace = false) {
- HTTPResponse::setResponseHeader(name, value, replace);
+ void doResponseHeader(const char* name, const char* value, bool replace = false) {
if (name && *name) {
// Set for later.
if (replace || !value)
diff --git a/iis/IIS7Request.cpp b/iis/IIS7Request.cpp
index 02716ed0..1ee056ee 100644
--- a/iis/IIS7Request.cpp
+++ b/iis/IIS7Request.cpp
@@ -448,10 +448,8 @@ long IIS7Request::sendResponse(istream& in, long status)
return RQ_NOTIFICATION_FINISH_REQUEST;
}
-void IIS7Request::setResponseHeader(const char* name, const char* value, bool replace)
+void IIS7Request::doResponseHeader(const char* name, const char* value, bool replace)
{
- HTTPResponse::setResponseHeader(name, value, replace);
-
size_t sz = value ? strlen(value) : 0;
if (sz > USHRT_MAX) {
log(Priority::SHIB_WARN, "Header value overflow");
diff --git a/iis/headers/IIS7Request.hpp b/iis/headers/IIS7Request.hpp
index c82bd230..03894b9d 100644
--- a/iis/headers/IIS7Request.hpp
+++ b/iis/headers/IIS7Request.hpp
@@ -74,8 +74,8 @@ protected:
string getSecureHeader(const char* name) const;
long sendResponse(istream& in, long status);
- void setResponseHeader(const char* name, const char* value, bool replace=false);
- long sendRedirect(const char* url);
+ void doResponseHeader(const char* name, const char* value, bool replace=false);
+ long dodRedirect(const char* url);
private:
void logFatal(const string& operation, HRESULT hr) const;
diff --git a/shibsp/AbstractSPRequest.cpp b/shibsp/AbstractSPRequest.cpp
index 46c566d8..0fbbbbd9 100644
--- a/shibsp/AbstractSPRequest.cpp
+++ b/shibsp/AbstractSPRequest.cpp
@@ -538,6 +538,25 @@ bool AbstractSPRequest::isPriorityEnabled(Priority::Value level) const
return m_log.isPriorityEnabled(level);
}
+void AbstractSPRequest::setResponseHeader(const char* name, const char* value, bool replace)
+{
+ if (name) {
+ for (const char* ch=name; *ch; ++ch) {
+ if (iscntrl(*ch))
+ throw domain_error("Response header name contained a control character.");
+ }
+ }
+
+ if (value) {
+ for (const char* ch=value; *ch; ++ch) {
+ if (iscntrl(*ch))
+ throw domain_error("Value for response header contained a control character.");
+ }
+ }
+
+ doResponseHeader(name, value, replace);
+}
+
long AbstractSPRequest::sendRedirect(const char* url, bool limit)
{
if (!url) {
diff --git a/shibsp/AbstractSPRequest.h b/shibsp/AbstractSPRequest.h
index 137d1be1..a3547044 100644
--- a/shibsp/AbstractSPRequest.h
+++ b/shibsp/AbstractSPRequest.h
@@ -88,6 +88,10 @@ namespace shibsp {
std::string getSecureHeader(const char* name) const;
void setAuthType(const char* authtype);
+ // Calls doResponseHeader to perform actual operation after
+ // sanitizing the name/value.
+ void setResponseHeader(const char* name, const char* value, bool replace = false);
+
// Calls doRedirect to perform the actual operation after
// sanitzing the URL as required.
long sendRedirect(const char* url, bool limit=false);
@@ -98,6 +102,15 @@ namespace shibsp {
bool isPriorityEnabled(Priority::Value level) const;
protected:
+ /**
+ * Sets or adds a response header.
+ *
+ * @param name header name
+ * @param value header value
+ * @param replace true iff existing header should be overwritten
+ */
+ virtual void doResponseHeader(const char* name, const char* value, bool replace=false)=0;
+
/**
* Check for unsafe URLs vulnerable to injection attacks and promote
* relative URLs to absolute based on current request.
diff --git a/shibsp/io/HTTPResponse.h b/shibsp/io/HTTPResponse.h
index 16c02ac1..326112e4 100644
--- a/shibsp/io/HTTPResponse.h
+++ b/shibsp/io/HTTPResponse.h
@@ -59,7 +59,7 @@ namespace shibsp {
* @param value value to set, or nullptr to clear
* @param replace true iff this should replace existing header(s)
*/
- virtual void setResponseHeader(const char* name, const char* value, bool replace = false);
+ virtual void setResponseHeader(const char* name, const char* value, bool replace = false)=0;
/**
* Sets or clears the MIME type of the response.
diff --git a/shibsp/io/impl/HTTPResponse.cpp b/shibsp/io/impl/HTTPResponse.cpp
index f2986e9e..9aeaffcc 100644
--- a/shibsp/io/impl/HTTPResponse.cpp
+++ b/shibsp/io/impl/HTTPResponse.cpp
@@ -45,23 +45,6 @@ void HTTPResponse::setContentType(const char* type)
setResponseHeader("Content-Type", type);
}
-void HTTPResponse::setResponseHeader(const char* name, const char* value, bool)
-{
- if (name) {
- for (const char* ch=name; *ch; ++ch) {
- if (iscntrl(*ch))
- throw domain_error("Response header name contained a control character.");
- }
- }
-
- if (value) {
- for (const char* ch=value; *ch; ++ch) {
- if (iscntrl(*ch))
- throw domain_error("Value for response header contained a control character.");
- }
- }
-}
-
long HTTPResponse::sendError(istream& inputStream)
{
return sendResponse(inputStream, SHIBSP_HTTP_STATUS_ERROR);
diff --git a/tests/DummyRequest.h b/tests/DummyRequest.h
index 6c706c27..5d8a90ea 100644
--- a/tests/DummyRequest.h
+++ b/tests/DummyRequest.h
@@ -50,8 +50,7 @@ namespace shibsp {
long sendResponse(std::istream&, long status) { return status; }
void clearHeader(const char* name) {}
void setHeader(const char* name, const char* value) {}
- void setResponseHeader(const char* name, const char* value, bool replace=false) {
- HTTPResponse::setResponseHeader(name, value, replace);
+ void doResponseHeader(const char* name, const char* value, bool replace=false) {
m_responseHeaders[name] = value ? value : "";
}
void setRemoteUser(const char*) {}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list