Recipient/Destination checks were including query string.

[shibboleth/opensaml2.git] / saml / saml2 / binding / impl / SAML2RedirectDecoder.cpp

diff --git a/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp b/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp
index 5927613..6d9eff7 100644 (file)
--- a/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp
+++ b/saml/saml2/binding/impl/SAML2RedirectDecoder.cpp
@@ -48,7 +48,7 @@ namespace opensaml {
         class SAML_DLLLOCAL SAML2RedirectDecoder : public MessageDecoder
         {
         public:
-            SAML2RedirectDecoder(const DOMElement* e) {}
+            SAML2RedirectDecoder() {}
             virtual ~SAML2RedirectDecoder() {}
             
             xmltooling::XMLObject* decode(
@@ -58,9 +58,9 @@ namespace opensaml {
                 ) const;
         };                
 
-        MessageDecoder* SAML_DLLLOCAL SAML2RedirectDecoderFactory(const DOMElement* const & e)
+        MessageDecoder* SAML_DLLLOCAL SAML2RedirectDecoderFactory(const pair<const DOMElement*,const XMLCh*>& p)
         {
-            return new SAML2RedirectDecoder(e);
+            return new SAML2RedirectDecoder();
         }
     };
 };
@@ -143,12 +143,13 @@ XMLObject* SAML2RedirectDecoder::decode(
     // Check destination URL.
     auto_ptr_char dest(request ? request->getDestination() : response->getDestination());
     const char* dest2 = httpRequest->getRequestURL();
+    const char* delim = strchr(dest2, '?');
     if ((root->getSignature() || httpRequest->getParameter("Signature")) && (!dest.get() || !*(dest.get()))) {
         log.error("signed SAML message missing Destination attribute");
         throw BindingException("Signed SAML message missing Destination attribute identifying intended destination.");
     }
-    else if (dest.get() && (!dest2 || !*dest2 || strcmp(dest.get(),dest2))) {
-        log.error("Redirect targeted at (%s), but delivered to (%s)", dest.get(), dest2 ? dest2 : "none");
+    else if ((delim && strncmp(dest.get(), dest2, delim - dest2)) || (!delim && strcmp(dest.get(),dest2))) {
+        log.error("Redirect targeted at (%s), but delivered to (%s)", dest.get(), dest2);
         throw BindingException("SAML message delivered with Redirect to incorrect server URL.");
     }