From fef3b8aa4629acf08791580fd7d09b35218061f6 Mon Sep 17 00:00:00 2001 From: Scott Cantor Date: Wed, 25 Jul 2007 17:29:50 +0000 Subject: [PATCH] Recipient/Destination checks were including query string. --- saml/saml1/binding/impl/SAML1POSTDecoder.cpp | 5 +++-- saml/saml2/binding/impl/SAML2POSTDecoder.cpp | 5 +++-- saml/saml2/binding/impl/SAML2RedirectDecoder.cpp | 5 +++-- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/saml/saml1/binding/impl/SAML1POSTDecoder.cpp b/saml/saml1/binding/impl/SAML1POSTDecoder.cpp index b9651ab..bc00f7f 100644 --- a/saml/saml1/binding/impl/SAML1POSTDecoder.cpp +++ b/saml/saml1/binding/impl/SAML1POSTDecoder.cpp @@ -116,12 +116,13 @@ XMLObject* SAML1POSTDecoder::decode( // Check recipient URL. auto_ptr_char recipient(response->getRecipient()); const char* recipient2 = httpRequest->getRequestURL(); + const char* delim = strchr(recipient2, '?'); if (!recipient.get() || !*(recipient.get())) { log.error("response missing Recipient attribute"); throw BindingException("SAML response did not contain Recipient attribute identifying intended destination."); } - else if (!recipient2 || !*recipient2 || strcmp(recipient.get(),recipient2)) { - log.error("POST targeted at (%s), but delivered to (%s)", recipient.get(), recipient2 ? recipient2 : "none"); + else if ((delim && strncmp(recipient.get(), recipient2, delim - recipient2)) || (!delim && strcmp(recipient.get(),recipient2))) { + log.error("POST targeted at (%s), but delivered to (%s)", recipient.get(), recipient2); throw BindingException("SAML message delivered with POST to incorrect server URL."); } diff --git a/saml/saml2/binding/impl/SAML2POSTDecoder.cpp b/saml/saml2/binding/impl/SAML2POSTDecoder.cpp index db218a0..f85e0f3 100644 --- a/saml/saml2/binding/impl/SAML2POSTDecoder.cpp +++ b/saml/saml2/binding/impl/SAML2POSTDecoder.cpp @@ -129,12 +129,13 @@ XMLObject* SAML2POSTDecoder::decode( // Check destination URL. auto_ptr_char dest(request ? request->getDestination() : response->getDestination()); const char* dest2 = httpRequest->getRequestURL(); + const char* delim = strchr(dest2, '?'); if ((root->getSignature() || httpRequest->getParameter("Signature")) && (!dest.get() || !*(dest.get()))) { log.error("signed SAML message missing Destination attribute"); throw BindingException("Signed SAML message missing Destination attribute identifying intended destination."); } - else if (dest.get() && (!dest2 || !*dest2 || strcmp(dest.get(),dest2))) { - log.error("POST targeted at (%s), but delivered to (%s)", dest.get(), dest2 ? dest2 : "none"); + else if ((delim && strncmp(dest.get(), dest2, delim - dest2)) || (!delim && strcmp(dest.get(),dest2))) { + log.error("POST targeted at (%s), but delivered to (%s)", dest.get(), dest2); throw BindingException("SAML message delivered with POST to incorrect server URL."); } diff --git a/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp b/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp index f325044..6d9eff7 100644 --- a/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp +++ b/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp @@ -143,12 +143,13 @@ XMLObject* SAML2RedirectDecoder::decode( // Check destination URL. auto_ptr_char dest(request ? request->getDestination() : response->getDestination()); const char* dest2 = httpRequest->getRequestURL(); + const char* delim = strchr(dest2, '?'); if ((root->getSignature() || httpRequest->getParameter("Signature")) && (!dest.get() || !*(dest.get()))) { log.error("signed SAML message missing Destination attribute"); throw BindingException("Signed SAML message missing Destination attribute identifying intended destination."); } - else if (dest.get() && (!dest2 || !*dest2 || strcmp(dest.get(),dest2))) { - log.error("Redirect targeted at (%s), but delivered to (%s)", dest.get(), dest2 ? dest2 : "none"); + else if ((delim && strncmp(dest.get(), dest2, delim - dest2)) || (!delim && strcmp(dest.get(),dest2))) { + log.error("Redirect targeted at (%s), but delivered to (%s)", dest.get(), dest2); throw BindingException("SAML message delivered with Redirect to incorrect server URL."); } -- 2.1.4