Allow remoting of unsafe strings, and protect encoding of RelayState URLs.

[shibboleth/cpp-sp.git] / shibsp / handler / impl / RemotedHandler.cpp

diff --git a/shibsp/handler/impl/RemotedHandler.cpp b/shibsp/handler/impl/RemotedHandler.cpp
index 477bdd7..2ee35a1 100644 (file)
--- a/shibsp/handler/impl/RemotedHandler.cpp
+++ b/shibsp/handler/impl/RemotedHandler.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright 2001-2007 Internet2
+ *  Copyright 2001-2009 Internet2
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,11 +27,10 @@
 #include "handler/RemotedHandler.h"
 
 #include <algorithm>
-#include <log4cpp/Category.hh>
 #include <xmltooling/unicode.h>
 
 #ifndef SHIBSP_LITE
-# include <saml/util/CGIParser.h>
+# include "util/CGIParser.h"
 # include <xsec/enc/OpenSSL/OpenSSLCryptoX509.hpp>
 # include <xsec/enc/XSECCryptoException.hpp>
 # include <xsec/framework/XSECException.hpp>
@@ -41,7 +40,6 @@
 using namespace shibsp;
 using namespace opensaml;
 using namespace xmltooling;
-using namespace log4cpp;
 using namespace xercesc;
 using namespace std;
 
@@ -199,15 +197,16 @@ void RemotedResponse::setResponseHeader(const char* name, const char* value)
         m_output.structure();
     DDF hdrs = m_output["headers"];
     if (hdrs.isnull())
-        hdrs = m_output.addmember("headers").structure();
-    hdrs.addmember(name).string(value);
+        hdrs = m_output.addmember("headers").list();
+    DDF h = DDF(name).string(value);
+    hdrs.add(h);
 }
 
 long RemotedResponse::sendRedirect(const char* url)
 {
     if (!m_output.isstruct())
         m_output.structure();
-    m_output.addmember("redirect").string(url);
+    m_output.addmember("redirect").unsafe_string(url);
     return HTTPResponse::XMLTOOLING_HTTP_STATUS_MOVED;
 }
 
@@ -241,7 +240,7 @@ DDF RemotedHandler::wrap(const SPRequest& request, const vector<string>* headers
     DDF in = DDF(m_address.c_str()).structure();
     in.addmember("application_id").string(request.getApplication().getId());
     in.addmember("scheme").string(request.getScheme());
-    in.addmember("hostname").string(request.getHostname());
+    in.addmember("hostname").unsafe_string(request.getHostname());
     in.addmember("port").integer(request.getPort());
     in.addmember("content_type").string(request.getContentType().c_str());
     in.addmember("content_length").integer(request.getContentLength());
@@ -249,8 +248,8 @@ DDF RemotedHandler::wrap(const SPRequest& request, const vector<string>* headers
     in.addmember("remote_user").string(request.getRemoteUser().c_str());
     in.addmember("client_addr").string(request.getRemoteAddr().c_str());
     in.addmember("method").string(request.getMethod());
-    in.addmember("uri").string(request.getRequestURI());
-    in.addmember("url").string(request.getRequestURL());
+    in.addmember("uri").unsafe_string(request.getRequestURI());
+    in.addmember("url").unsafe_string(request.getRequestURL());
     in.addmember("query").string(request.getQueryString());
 
     if (headers) {
@@ -299,7 +298,8 @@ pair<bool,long> RemotedHandler::unwrap(SPRequest& request, DDF& out) const
         if (!stricmp(hdr.name(), "Content-Type"))
 #endif
             request.setContentType(hdr.string());
-        request.setResponseHeader(hdr.name(), hdr.string());
+        else
+            request.setResponseHeader(hdr.name(), hdr.string());
         hdr = h.next();
     }
     h = out["redirect"];
@@ -310,7 +310,7 @@ pair<bool,long> RemotedHandler::unwrap(SPRequest& request, DDF& out) const
         istringstream s(h["data"].string());
         return make_pair(true, request.sendResponse(s, h["status"].integer()));
     }
-    return make_pair(false,0);
+    return make_pair(false,0L);
 }
 
 HTTPRequest* RemotedHandler::getRequest(DDF& in) const