dani/lemonldap-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid to match non-Lemon cookie (#2417)

Browse Source
This commit is contained in:
Christophe Maudoux 2020-12-18 23:20:54 +01:00
parent e9487a42d7
commit 6f3938d014
2 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lemonldap-ng-handler/lib/Lemonldap/NG/Handler/Main/Run.pm
View File

@ -499,8 +499,8 @@ sub fetchId {
and not $class->_isHttps( $req, $vhost ) );
my $cn = $class->tsv->{cookieName};
my $value = $lookForHttpCookie # Avoid prefix and bad cookie name (#2417)
? ( $t =~ /(?<!-)\b${cn}http=([^,; ]+)/o ? $1 : 0 )
: ( $t =~ /(?<!-)\b$cn=([^,; ]+)/o ? $1 : 0 );
? ( $t =~ /(?<![-.~])\b${cn}http=([^,; ]+)/o ? $1 : 0 )
: ( $t =~ /(?<![-.~])\b$cn=([^,; ]+)/o ? $1 : 0 );
if ( $value && $lookForHttpCookie && $class->tsv->{securedCookie} == 3 ) {
$value = $class->tsv->{cipher}->decryptHex( $value, "http" );

26
lemonldap-ng-handler/t/60-Lemonldap-NG-Handler-PSGI.t
View File

@ -127,14 +127,32 @@ count(3);
# Bad cookie name
ok( $res = $client->_get( '/', undef, undef, "fakelemonldap=$sessionId" ),
'Unauthentified query' );
ok( $res->[0] == 302, ' Code is 302' ) or explain( $res, 302 );
'Bad cookie name' );
ok( $res->[0] == 302, ' Code is 302 (name)' ) or explain( $res, 302 );
count(2);
# Bad cookie name
ok( $res = $client->_get( '/', undef, undef, "fake-lemonldap=$sessionId" ),
'Unauthentified query' );
ok( $res->[0] == 302, ' Code is 302' ) or explain( $res, 302 );
'Bad cookie name (-)' );
ok( $res->[0] == 302, ' Code is 302 (-)' ) or explain( $res, 302 );
count(2);
# Bad cookie name
ok( $res = $client->_get( '/', undef, undef, "fake.lemonldap=$sessionId" ),
'Bad cookie name (.)' );
ok( $res->[0] == 302, ' Code is 302 (.)' ) or explain( $res, 302 );
count(2);
# Bad cookie name
ok( $res = $client->_get( '/', undef, undef, "fake_lemonldap=$sessionId" ),
'Bad cookie name (_)' );
ok( $res->[0] == 302, ' Code is 302 (_)' ) or explain( $res, 302 );
count(2);
# Bad cookie name
ok( $res = $client->_get( '/', undef, undef, "fake~lemonldap=$sessionId" ),
'Bad cookie name (~)' );
ok( $res->[0] == 302, ' Code is 302 (~)' ) or explain( $res, 302 );
count(2);
# Bad cookie