X-Git-Url: http://www.project-moonshot.org/gitweb/?p=shibboleth%2Fcpp-opensaml.git;a=blobdiff_plain;f=saml%2Fsaml2%2Fbinding%2Fimpl%2FSAML2POSTDecoder.cpp;h=e873d8facb0eaa45702955d22b65b24056cd69bc;hp=5f763f5ba4c9eae89b0508a4bc307f09710cb434;hb=1462057b3b9ae7e165d34d988e30b14c213672ca;hpb=289c2fd5238a066880fa5ccd74fca2de11da1578 diff --git a/saml/saml2/binding/impl/SAML2POSTDecoder.cpp b/saml/saml2/binding/impl/SAML2POSTDecoder.cpp index 5f763f5..e873d8f 100644 --- a/saml/saml2/binding/impl/SAML2POSTDecoder.cpp +++ b/saml/saml2/binding/impl/SAML2POSTDecoder.cpp @@ -1,57 +1,77 @@ -/* - * Copyright 2001-2007 Internet2 - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at +/** + * Licensed to the University Corporation for Advanced Internet + * Development, Inc. (UCAID) under one or more contributor license + * agreements. See the NOTICE file distributed with this work for + * additional information regarding copyright ownership. * - * http://www.apache.org/licenses/LICENSE-2.0 + * UCAID licenses this file to you under the Apache License, + * Version 2.0 (the "License"); you may not use this file except + * in compliance with the License. You may obtain a copy of the + * License at * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific + * language governing permissions and limitations under the License. */ /** * SAML2POSTDecoder.cpp * - * SAML 2.0 HTTP POST binding message encoder + * SAML 2.0 HTTP POST binding message encoder. */ #include "internal.h" #include "exceptions.h" -#include "binding/HTTPRequest.h" -#include "saml2/binding/SAML2POSTDecoder.h" +#include "binding/SecurityPolicy.h" +#include "saml2/binding/SAML2MessageDecoder.h" #include "saml2/core/Protocols.h" #include "saml2/metadata/Metadata.h" #include "saml2/metadata/MetadataProvider.h" -#include +#include +#include #include +#include +#include +#include #include +#include #include using namespace opensaml::saml2md; using namespace opensaml::saml2p; using namespace opensaml::saml2; using namespace opensaml; +using namespace xmltooling::logging; using namespace xmltooling; -using namespace log4cpp; using namespace std; namespace opensaml { namespace saml2p { - MessageDecoder* SAML_DLLLOCAL SAML2POSTDecoderFactory(const DOMElement* const & e) + class SAML_DLLLOCAL SAML2POSTDecoder : public SAML2MessageDecoder + { + public: + SAML2POSTDecoder() {} + virtual ~SAML2POSTDecoder() {} + + xmltooling::XMLObject* decode( + std::string& relayState, + const GenericRequest& genericRequest, + SecurityPolicy& policy + ) const; + }; + + MessageDecoder* SAML_DLLLOCAL SAML2POSTDecoderFactory(const pair&) { - return new SAML2POSTDecoder(e); + return new SAML2POSTDecoder(); } }; }; -SAML2POSTDecoder::SAML2POSTDecoder(const DOMElement* e) {} - XMLObject* SAML2POSTDecoder::decode( std::string& relayState, const GenericRequest& genericRequest, @@ -61,21 +81,19 @@ XMLObject* SAML2POSTDecoder::decode( #ifdef _DEBUG xmltooling::NDC ndc("decode"); #endif - Category& log = Category::getInstance(SAML_LOGCAT".MessageDecoder.SAML2POST"); + Category& log = Category::getInstance(SAML_LOGCAT ".MessageDecoder.SAML2POST"); log.debug("validating input"); const HTTPRequest* httpRequest=dynamic_cast(&genericRequest); - if (!httpRequest) { - log.error("unable to cast request to HTTPRequest type"); - return NULL; - } + if (!httpRequest) + throw BindingException("Unable to cast request object to HTTPRequest type."); if (strcmp(httpRequest->getMethod(),"POST")) - return NULL; + throw BindingException("Invalid HTTP method ($1).", params(1, httpRequest->getMethod())); const char* msg = httpRequest->getParameter("SAMLResponse"); if (!msg) msg = httpRequest->getParameter("SAMLRequest"); if (!msg) - return NULL; + throw BindingException("Request missing SAMLRequest or SAMLResponse form parameter."); const char* state = httpRequest->getParameter("RelayState"); if (state) relayState = state; @@ -83,23 +101,23 @@ XMLObject* SAML2POSTDecoder::decode( relayState.erase(); // Decode the base64 into SAML. - unsigned int x; + xsecsize_t x; XMLByte* decoded=Base64::decode(reinterpret_cast(msg),&x); if (!decoded) throw BindingException("Unable to decode base64 in POST binding message."); - log.debug("decoded SAML message:\n%s", decoded); - istringstream is(reinterpret_cast(decoded)); - XMLString::release(&decoded); + log.debugStream() << "decoded SAML message:\n" << decoded << logging::eol; // Parse and bind the document into an XMLObject. - DOMDocument* doc = (m_validate ? XMLToolingConfig::getConfig().getValidatingParser() - : XMLToolingConfig::getConfig().getParser()).parse(is); + MemBufInputSource src(decoded, x, "SAMLMessage", true); + Wrapper4InputSource dsrc(&src, false); + DOMDocument* doc = (policy.getValidating() ? XMLToolingConfig::getConfig().getValidatingParser() + : XMLToolingConfig::getConfig().getParser()).parse(dsrc); XercesJanitor janitor(doc); auto_ptr xmlObject(XMLObjectBuilder::buildOneFromElement(doc->getDocumentElement(), true)); janitor.release(); - saml2::RootObject* root = NULL; - StatusResponseType* response = NULL; + saml2::RootObject* root = nullptr; + StatusResponseType* response = nullptr; RequestAbstractType* request = dynamic_cast(xmlObject.get()); if (!request) { response = dynamic_cast(xmlObject.get()); @@ -111,21 +129,22 @@ XMLObject* SAML2POSTDecoder::decode( root = static_cast(request); } - if (!m_validate) - SchemaValidators.validate(xmlObject.get()); + SchemaValidators.validate(root); // Run through the policy. + extractMessageDetails(*root, genericRequest, samlconstants::SAML20P_NS, policy); policy.evaluate(*root, &genericRequest); // Check destination URL. auto_ptr_char dest(request ? request->getDestination() : response->getDestination()); const char* dest2 = httpRequest->getRequestURL(); - if ((root->getSignature() || httpRequest->getParameter("Signature")) && !dest.get() || !*(dest.get())) { + const char* delim = strchr(dest2, '?'); + if ((root->getSignature() || httpRequest->getParameter("Signature")) && (!dest.get() || !*(dest.get()))) { log.error("signed SAML message missing Destination attribute"); throw BindingException("Signed SAML message missing Destination attribute identifying intended destination."); } - else if (dest.get() && (!dest2 || !*dest2 || strcmp(dest.get(),dest2))) { - log.error("POST targeted at (%s), but delivered to (%s)", dest.get(), dest2 ? dest2 : "none"); + else if (dest.get() && *dest.get() && ((delim && strncmp(dest.get(), dest2, delim - dest2)) || (!delim && strcmp(dest.get(),dest2)))) { + log.error("POST targeted at (%s), but delivered to (%s)", dest.get(), dest2); throw BindingException("SAML message delivered with POST to incorrect server URL."); }