From bd8e65e2c699efcb3efcdfbda89b1ff1eab85cc4 Mon Sep 17 00:00:00 2001
From: Scott Cantor <cantor.2@osu.edu>
Date: Sat, 13 Jun 2009 03:55:55 +0000
Subject: [PATCH] Adding header sanitizing option.

---
 configs/shibboleth2.xml                     | 2 +-
 schemas/shibboleth-2.0-native-sp-config.xsd | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/configs/shibboleth2.xml b/configs/shibboleth2.xml
index 9458846..0cfc813 100644
--- a/configs/shibboleth2.xml
+++ b/configs/shibboleth2.xml
@@ -16,7 +16,7 @@
     
     <!-- The InProcess section conrains settings affecting web server modules/filters. -->
     <InProcess logger="native.logger">
-        <ISAPI normalizeRequest="true">
+        <ISAPI normalizeRequest="true" safeHeaderNames="true">
             <!--
             Maps IIS Instance ID values to the host scheme/name/port. The name is
             required so that the proper <Host> in the request map above is found without
diff --git a/schemas/shibboleth-2.0-native-sp-config.xsd b/schemas/shibboleth-2.0-native-sp-config.xsd
index 5da0039..88befab 100644
--- a/schemas/shibboleth-2.0-native-sp-config.xsd
+++ b/schemas/shibboleth-2.0-native-sp-config.xsd
@@ -200,10 +200,10 @@
 				<any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
 			</sequence>
 			<attribute name="logger" type="anyURI"/>
-			<attribute name="unsetHeaderValue" type="string"/>
+			<attribute name="unsetHeaderValue" type="conf:string"/>
 			<attribute name="checkSpoofing" type="boolean"/>
-            <attribute name="spoofKey" type="string"/>
-		    <attribute name="catchAll" type="boolean"/>
+			<attribute name="spoofKey" type="conf:string"/>
+			<attribute name="catchAll" type="boolean"/>
 			<anyAttribute namespace="##other" processContents="lax"/>
 		</complexType>
 	</element>
@@ -226,6 +226,7 @@
 				<any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
 			</sequence>
 			<attribute name="normalizeRequest" type="boolean"/>
+			<attribute name="safeHeaderNames" type="boolean"/>
 			<anyAttribute namespace="##other" processContents="lax"/>
 		</complexType>
 	</element>
-- 
2.1.4