https://issues.shibboleth.net/jira/browse/SSPCPP-321

diff --git a/shibsp/Makefile.am b/shibsp/Makefile.am
index 9766dbd..9b96cc9 100644 (file)
--- a/shibsp/Makefile.am
+++ b/shibsp/Makefile.am
@@ -175,6 +175,7 @@ libshibsp_la_SOURCES = \
        attribute/XMLAttributeDecoder.cpp \
        attribute/filtering/impl/AttributeFilter.cpp \
        attribute/filtering/impl/ChainingAttributeFilter.cpp \
+       attribute/filtering/impl/DummyAttributeFilter.cpp \
        attribute/filtering/impl/XMLAttributeFilter.cpp \
        attribute/filtering/impl/BasicFilteringContext.cpp \
        attribute/filtering/impl/MatchFunctor.cpp \

diff --git a/shibsp/attribute/filtering/AttributeFilter.h b/shibsp/attribute/filtering/AttributeFilter.h
index 2a249e4..635c758 100644 (file)
--- a/shibsp/attribute/filtering/AttributeFilter.h
+++ b/shibsp/attribute/filtering/AttributeFilter.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright 2001-2009 Internet2
+ *  Copyright 2001-2010 Internet2
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -63,6 +63,9 @@ namespace shibsp {
     /** AttributeFilter based on an XML mapping schema. */
     #define XML_ATTRIBUTE_FILTER "XML"
 
+    /** AttributeFilter based on rejecting/blocking all attributes. */
+    #define DUMMY_ATTRIBUTE_FILTER "Dummy"
+
     /** AttributeFilter based on chaining together other filters. */
     #define CHAINING_ATTRIBUTE_FILTER "Chaining"
 };

diff --git a/shibsp/attribute/filtering/impl/AttributeFilter.cpp b/shibsp/attribute/filtering/impl/AttributeFilter.cpp
index dc67e1f..a1fcf0f 100644 (file)
--- a/shibsp/attribute/filtering/impl/AttributeFilter.cpp
+++ b/shibsp/attribute/filtering/impl/AttributeFilter.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright 2001-2009 Internet2
+ *  Copyright 2001-2010 Internet2
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,6 +29,7 @@ using namespace std;
 
 namespace shibsp {
     SHIBSP_DLLLOCAL PluginManager<AttributeFilter,string,const DOMElement*>::Factory XMLAttributeFilterFactory;
+    SHIBSP_DLLLOCAL PluginManager<AttributeFilter,string,const DOMElement*>::Factory DummyAttributeFilterFactory;
     SHIBSP_DLLLOCAL PluginManager<AttributeFilter,string,const DOMElement*>::Factory ChainingAttributeFilterFactory;
 };
 
@@ -36,6 +37,7 @@ void SHIBSP_API shibsp::registerAttributeFilters()
 {
     SPConfig& conf = SPConfig::getConfig();
     conf.AttributeFilterManager.registerFactory(XML_ATTRIBUTE_FILTER, XMLAttributeFilterFactory);
+    conf.AttributeFilterManager.registerFactory(DUMMY_ATTRIBUTE_FILTER, DummyAttributeFilterFactory);
     conf.AttributeFilterManager.registerFactory(CHAINING_ATTRIBUTE_FILTER, ChainingAttributeFilterFactory);
 }
 

diff --git a/shibsp/attribute/filtering/impl/ChainingAttributeFilter.cpp b/shibsp/attribute/filtering/impl/ChainingAttributeFilter.cpp
index ee4201e..58acef2 100644 (file)
--- a/shibsp/attribute/filtering/impl/ChainingAttributeFilter.cpp
+++ b/shibsp/attribute/filtering/impl/ChainingAttributeFilter.cpp
@@ -21,6 +21,7 @@
  */
 
 #include "internal.h"
+#include "exceptions.h"
 #include "attribute/filtering/AttributeFilter.h"
 #include "attribute/filtering/FilteringContext.h"
 
@@ -69,25 +70,22 @@ namespace shibsp {
 
 ChainingAttributeFilter::ChainingAttributeFilter(const DOMElement* e)
 {
-    SPConfig& conf = SPConfig::getConfig();
-
     // Load up the chain of handlers.
-    e = XMLHelper::getFirstChildElement(e, _AttributeFilter);
-    while (e) {
-        string t(XMLHelper::getAttrString(e, nullptr, _type));
-        if (!t.empty()) {
-            try {
-                Category::getInstance(SHIBSP_LOGCAT".AttributeFilter.Chaining").info(
-                    "building AttributeFilter of type (%s)...", t.c_str()
-                    );
-                m_filters.push_back(conf.AttributeFilterManager.newPlugin(t.c_str(), e));
-            }
-            catch (exception& ex) {
-                Category::getInstance(SHIBSP_LOGCAT".AttributeFilter.Chaining").error(
-                    "caught exception processing embedded AttributeFilter element: %s", ex.what()
-                    );
+    try {
+        e = XMLHelper::getFirstChildElement(e, _AttributeFilter);
+        while (e) {
+            string t(XMLHelper::getAttrString(e, nullptr, _type));
+            if (!t.empty()) {
+                Category::getInstance(SHIBSP_LOGCAT".AttributeFilter.Chaining").info("building AttributeFilter of type (%s)...", t.c_str());
+                m_filters.push_back(SPConfig::getConfig().AttributeFilterManager.newPlugin(t.c_str(), e));
             }
+            e = XMLHelper::getNextSiblingElement(e, _AttributeFilter);
         }
-        e = XMLHelper::getNextSiblingElement(e, _AttributeFilter);
     }
+    catch (exception&) {
+        for_each(m_filters.begin(), m_filters.end(), xmltooling::cleanup<AttributeFilter>());
+        throw;
+    }
+    if (m_filters.empty())
+        throw ConfigurationException("Chaining AttributeFilter plugin requires at least one child plugin.");
 }

diff --git a/shibsp/attribute/filtering/impl/DummyAttributeFilter.cpp b/shibsp/attribute/filtering/impl/DummyAttributeFilter.cpp
new file mode 100644 (file)
index 0000000..1fe4dc9
--- /dev/null
+++ b/shibsp/attribute/filtering/impl/DummyAttributeFilter.cpp
@@ -0,0 +1,58 @@
+/*\r
+ *  Copyright 2010 Internet2\r
+ * \r
+ * Licensed under the Apache License, Version 2.0 (the "License");\r
+ * you may not use this file except in compliance with the License.\r
+ * You may obtain a copy of the License at\r
+ *\r
+ *     http://www.apache.org/licenses/LICENSE-2.0\r
+ *\r
+ * Unless required by applicable law or agreed to in writing, software\r
+ * distributed under the License is distributed on an "AS IS" BASIS,\r
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
+ * See the License for the specific language governing permissions and\r
+ * limitations under the License.\r
+ */\r
+\r
+/**\r
+ * DummyAttributeFilter.cpp\r
+ * \r
+ * Pathological AttributeFilter that rejects all attributes.\r
+ */\r
+\r
+#include "internal.h"\r
+#include "attribute/Attribute.h"\r
+#include "attribute/filtering/AttributeFilter.h"\r
+\r
+using namespace shibsp;\r
+using namespace xmltooling;\r
+using namespace std;\r
+\r
+namespace shibsp {\r
+\r
+    class SHIBSP_DLLLOCAL DummyAttributeFilter : public AttributeFilter\r
+    {\r
+    public:\r
+        DummyAttributeFilter(const DOMElement* e) {\r
+        }\r
+        virtual ~DummyAttributeFilter() {\r
+        }\r
+        \r
+        Lockable* lock() {\r
+            return this;\r
+        }\r
+        void unlock() {\r
+        }\r
+        \r
+        void filterAttributes(const FilteringContext& context, vector<Attribute*>& attributes) const {\r
+            Category::getInstance(SHIBSP_LOGCAT".AttributeFilter.Dummy").warn("filtering out all attributes");\r
+            for_each(attributes.begin(), attributes.end(), xmltooling::cleanup<Attribute>());\r
+            attributes.clear();\r
+        }\r
+    };\r
+\r
+    AttributeFilter* SHIBSP_DLLLOCAL DummyAttributeFilterFactory(const DOMElement* const & e)\r
+    {\r
+        return new DummyAttributeFilter(e);\r
+    }\r
+};\r

diff --git a/shibsp/impl/XMLServiceProvider.cpp b/shibsp/impl/XMLServiceProvider.cpp
index 51e90c1..1dfc15d 100644 (file)
--- a/shibsp/impl/XMLServiceProvider.cpp
+++ b/shibsp/impl/XMLServiceProvider.cpp
@@ -203,7 +203,8 @@ namespace {
             const char* chainingType,
             const XMLCh* localName,
             DOMElement* e,
-            Category& log
+            Category& log,
+            const char* dummyType=nullptr
             );
         void doAttributeInfo();
         void doHandlers(const ProtocolProvider*, const DOMElement*, Category&);
@@ -681,7 +682,8 @@ template <class T> T* XMLApplication::doChainedPlugins(
     const char* chainingType,
     const XMLCh* localName,
     DOMElement* e,
-    Category& log
+    Category& log,
+    const char* dummyType
     )
 {
     string t;
@@ -715,6 +717,11 @@ template <class T> T* XMLApplication::doChainedPlugins(
         }
         catch (exception& ex) {
             log.crit("error building %s: %s", pluginType, ex.what());
+            if (dummyType) {
+                // Install a dummy version as a safety valve.
+                log.crit("installing safe %s in place of failed version", pluginType);
+                return pluginMgr.newPlugin(dummyType, nullptr);
+            }
         }
     }
 
@@ -1321,7 +1328,7 @@ void XMLApplication::doAttributePlugins(DOMElement* e, Category& log)
         doChainedPlugins(conf.AttributeExtractorManager, "AttributeExtractor", CHAINING_ATTRIBUTE_EXTRACTOR, _AttributeExtractor, e, log);
 
     m_attrFilter =
-        doChainedPlugins(conf.AttributeFilterManager, "AttributeFilter", CHAINING_ATTRIBUTE_FILTER, _AttributeFilter, e, log);
+        doChainedPlugins(conf.AttributeFilterManager, "AttributeFilter", CHAINING_ATTRIBUTE_FILTER, _AttributeFilter, e, log, DUMMY_ATTRIBUTE_FILTER);
 
     m_attrResolver =
         doChainedPlugins(conf.AttributeResolverManager, "AttributeResolver", CHAINING_ATTRIBUTE_RESOLVER, _AttributeResolver, e, log);

diff --git a/shibsp/shibsp.vcxproj b/shibsp/shibsp.vcxproj
index 30750b3..786536f 100644 (file)
--- a/shibsp/shibsp.vcxproj
+++ b/shibsp/shibsp.vcxproj
@@ -183,6 +183,7 @@
     <ClCompile Include="AbstractSPRequest.cpp" />\r
     <ClCompile Include="Application.cpp" />\r
     <ClCompile Include="attribute\Base64AttributeDecoder.cpp" />\r
+    <ClCompile Include="attribute\filtering\impl\DummyAttributeFilter.cpp" />\r
     <ClCompile Include="attribute\filtering\impl\NameIDQualifierStringFunctor.cpp" />\r
     <ClCompile Include="binding\impl\XMLProtocolProvider.cpp" />\r
     <ClCompile Include="handler\impl\DiscoveryFeed.cpp" />\r

diff --git a/shibsp/shibsp.vcxproj.filters b/shibsp/shibsp.vcxproj.filters
index 15b7d70..cee9649 100644 (file)
--- a/shibsp/shibsp.vcxproj.filters
+++ b/shibsp/shibsp.vcxproj.filters
@@ -384,6 +384,9 @@
     <ClCompile Include="attribute\filtering\impl\NameIDQualifierStringFunctor.cpp">\r
       <Filter>Source Files\attribute\filtering\impl</Filter>\r
     </ClCompile>\r
+    <ClCompile Include="attribute\filtering\impl\DummyAttributeFilter.cpp">\r
+      <Filter>Source Files\attribute\filtering\impl</Filter>\r
+    </ClCompile>\r
   </ItemGroup>\r
   <ItemGroup>\r
     <ClInclude Include="remoting\impl\SocketListener.h">\r