[cpp-sp] branch main updated: Sanity check cookie value.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository cpp-sp.

View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/5e2913341a75901780e5a0fc85e678849e1b97b9

The following commit(s) were added to refs/heads/main by this push:
     new 5e291334 Sanity check cookie value.
5e291334 is described below

commit 5e2913341a75901780e5a0fc85e678849e1b97b9
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Fri Sep 18 10:57:30 2026 -0400

    Sanity check cookie value.
---
 shibsp/session/impl/AbstractSessionCache.cpp | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/shibsp/session/impl/AbstractSessionCache.cpp b/shibsp/session/impl/AbstractSessionCache.cpp
index f19c8980..fbbb358a 100644
--- a/shibsp/session/impl/AbstractSessionCache.cpp
+++ b/shibsp/session/impl/AbstractSessionCache.cpp
@@ -325,17 +325,34 @@ void AbstractSessionCache::log(const SPRequest* request, Category& log, Priority
 
 pair<string,unsigned int> AbstractSessionCache::parseCookieValue(const char* value)
 {
+    pair<string,unsigned int> ret;
+
+    // Check for an absent separator or a non-numeric one, and just force the version to 1.
+
     const char* sep = strrchr(value, '.');
     if (!sep) {
-        // Shouldn't happen, but we can handle it.
-        return make_pair(string(value), 1);
+        ret = make_pair(string(value), 1);
     }
     else if (!isdigit(*(sep + 1))) {
-        // Check for negative
-        return make_pair(string(value, sep), 1);
+        ret = make_pair(string(value, sep), 1);
+    }
+    else {
+        ret = make_pair(string(value, sep), atoi(sep +1));
     }
 
-    return make_pair(string(value, sep), atoi(sep +1));
+    // Check length and content of key string.
+
+    if (ret.first.length() > 64) {
+        throw SessionException("Session key parsed from cookie exceeded allowable length.");
+    }
+
+    for (const char& c : ret.first) {
+        if (!isxdigit(c)) {
+            throw SessionException("Session key parsed from cookie contained an illegal character.");
+        }
+    }
+
+    return ret;
 }
 
 string AbstractSessionCache::create(SPRequest& request, const char* candidateSessionID, DDF& data)

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.