Port up URI sanitizer from branch.

[shibboleth/sp.git] / shibsp / AbstractSPRequest.cpp

diff --git a/shibsp/AbstractSPRequest.cpp b/shibsp/AbstractSPRequest.cpp
index 103c2b3..dffe00c 100644 (file)
--- a/shibsp/AbstractSPRequest.cpp
+++ b/shibsp/AbstractSPRequest.cpp
@@ -113,7 +113,55 @@ Session* AbstractSPRequest::getSession(bool checkTimeout, bool ignoreAddress, bo
     return session;
 }
 
-const char* AbstractSPRequest::getRequestURL() const {
+static char _x2c(const char *what)\r
+{\r
+    register char digit;\r
+\r
+    digit = (what[0] >= 'A' ? ((what[0] & 0xdf) - 'A')+10 : (what[0] - '0'));\r
+    digit *= 16;\r
+    digit += (what[1] >= 'A' ? ((what[1] & 0xdf) - 'A')+10 : (what[1] - '0'));\r
+    return(digit);\r
+}\r
+
+void AbstractSPRequest::setRequestURI(const char* uri)
+{
+    // Fix for bug 574, secadv 20061002\r
+    // Unescape URI up to query string delimiter by looking for %XX escapes.\r
+    // Adapted from Apache's util.c, ap_unescape_url function.\r
+    if (uri) {\r
+        while (*uri) {\r
+            if (*uri == '?') {\r
+                m_uri += uri;\r
+                break;\r
+            }\r
+            else if (*uri == ';') {\r
+                // If this is Java being stupid, skip everything up to the query string, if any.\r
+                if (!strncmp(uri, ";jsessionid=", 12)) {\r
+                    if (uri = strchr(uri, '?'))\r
+                        m_uri += uri;\r
+                    break;\r
+                }\r
+                else {\r
+                    m_uri += *uri;\r
+                }\r
+            }\r
+            else if (*uri != '%') {\r
+                m_uri += *uri;\r
+            }\r
+            else {\r
+                ++uri;\r
+                if (!isxdigit(*uri) || !isxdigit(*(uri+1)))\r
+                    throw ConfigurationException("Bad request, contained unsupported encoded characters.");\r
+                m_uri += _x2c(uri);\r
+                ++uri;\r
+            }\r
+            ++uri;\r
+        }\r
+    }\r
+}
+
+const char* AbstractSPRequest::getRequestURL() const
+{
     if (m_url.empty()) {
         // Compute the full target URL
         int port = getPort();
@@ -124,9 +172,7 @@ const char* AbstractSPRequest::getRequestURL() const {
             portstr << port;
             m_url += ":" + portstr.str();
         }
-        scheme = getRequestURI();
-        if (scheme)
-            m_url += scheme;
+        m_url += m_uri;
     }
     return m_url.c_str();
 }