[cpp-sp] branch main updated: Fix bug overwriting the output when handling logout response

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository cpp-sp.

View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/8ab6c74ecb40da651c23a7d2646b24a9b301c64d

The following commit(s) were added to refs/heads/main by this push:
     new 8ab6c74e Fix bug overwriting the output when handling logout response
8ab6c74e is described below

commit 8ab6c74ecb40da651c23a7d2646b24a9b301c64d
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Mon Jun 8 15:33:23 2026 -0400

    Fix bug overwriting the output when handling logout response
---
 shibsp/handler/impl/AbstractHandler.cpp |  4 ++++
 shibsp/handler/impl/LogoutConsumer.cpp  | 27 ++++++++++++++++++++-------
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/shibsp/handler/impl/AbstractHandler.cpp b/shibsp/handler/impl/AbstractHandler.cpp
index b170e3c8..f4141352 100644
--- a/shibsp/handler/impl/AbstractHandler.cpp
+++ b/shibsp/handler/impl/AbstractHandler.cpp
@@ -173,6 +173,10 @@ DDF AbstractHandler::wrapRequest(const SPRequest& request, const set<string>& he
 pair<bool,long> AbstractHandler::unwrapResponse(SPRequest& request, DDF& wrappedResponse, bool limitRedirect) const
 {
     DDF http = wrappedResponse["http"];
+    if (!http.isstruct()) {
+        return make_pair(false, 0L);
+    }
+
     DDF h = http["headers"];
     DDF hdr = h.first();
     while (hdr.isstring()) {
diff --git a/shibsp/handler/impl/LogoutConsumer.cpp b/shibsp/handler/impl/LogoutConsumer.cpp
index e9b9f25b..70e91f38 100644
--- a/shibsp/handler/impl/LogoutConsumer.cpp
+++ b/shibsp/handler/impl/LogoutConsumer.cpp
@@ -144,9 +144,25 @@ pair<bool,long> LogoutConsumer::run(SPRequest& request, bool isHandler) const
     if (output["status"].isint()) {
         // Finish up a logout response. The session should be gone and if it wasn't
         // this is a spurious logout message so we don't act on it.
-        return completeLogout(request, false, nullptr);
+
+        // This sequence amounts to:
+        // 1. Try to unwrap a response from the Hub.
+        // 2. Fall back to a target parameter in the output.
+        // 3. Failing that, fall back to logoutURL/homeURL.
+        pair<bool,long> ret = unwrapResponse(request, output, true);
+        if (ret.first) {
+            return ret;
+        }
+
+        const char* dest = output.getmember("target").string();
+        if (!dest) {
+            dest = getHomeURL(request);
+        }
+        return make_pair(true, request.sendRedirect(dest, true));
     }
 
+    // At this point, the presumption is a logout request is being handled.
+
     // If we actually have a session in hand, we may need to initiate the notification loop.
     // Any token provided by the Hub call will be attached to that process.
     // We won't notify, however, if a match was required but not achieved.
@@ -218,12 +234,9 @@ pair <bool,long> LogoutConsumer::completeLogout(SPRequest& request, bool removeS
 
     DDFJanitor outputJanitor(output);
 
-    DDF wrapped = output.getmember("http");
-    if (wrapped.isstruct()) {
-        pair<bool,long> ret = unwrapResponse(request, output, token == nullptr);
-        if (ret.first) {
-            return ret;
-        }
+    pair<bool,long> ret = unwrapResponse(request, output, token == nullptr);
+    if (ret.first) {
+        return ret;
     }
 
     // If no explicit response from Hub, pull "target" from output if available.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.