Jasig/mod_auth_cas — pull request #31 by dune73 (2012-02-21 14:55:37+00:00)
Title: Format check on service ticket

* new include: pcre
* regex pattern: "^ticket=[SP]T-[a-zA-Z0-9-]+$"
* function getCASTicket: regex match on service tickets starting with "ST-" or "PT-"
* tickets failing check are noted in error log and then ignored

This change prevents XML injection via the service parameter. The pattern is based on http://www.jasig.org/cas/protocol section 3.7 (thanks to Phil for the hint).

CAUTION: I am not a developer. So please the code carefully. It is based on pcredemo.c from pcre.