commit 8ee578131b0ce334c0c5bd6f5a2bd96097875514
Author: Alejandro Alvarez Ayllon <alejandro.alvarez.ayllon@cern.ch>
Date:   Mon Nov 17 10:01:38 2014 +0100

    DMC-553: Accept only turls that have been requested

diff --git a/src/plugins/srm/gfal_srm_getput.c b/src/plugins/srm/gfal_srm_getput.c
index 94f5904..aaf8f19 100644
--- a/src/plugins/srm/gfal_srm_getput.c
+++ b/src/plugins/srm/gfal_srm_getput.c
@@ -26,6 +26,61 @@
 #include "gfal_srm_endpoint.h"
 
 
+// Make sure the TURL returned by the endpoint is one of the requested protocols
+static int validate_turls(int n_results, gfal_srm_result** resu,
+        gfal_srm_params_t params, GError** tmp_err)
+{
+    int failed = 0;
+    int n_protocols = g_strv_length(params->protocols);
+    int i, j;
+
+    for (i = 0; i < n_results && !failed; ++i) {
+        const char* turl = (*resu)[i].turl;
+
+        // Never ever accept file, even if it was asked for
+        if (strncmp("file:", turl, 5) == 0) {
+            failed = -1;
+            gfal2_set_error(tmp_err, gfal2_get_plugin_srm_quark(), EBADMSG, __func__,
+                    "file:// is not a valid turl");
+            break;
+        }
+        else if (turl[0] == '/') {
+            failed = -1;
+            gfal2_set_error(tmp_err, gfal2_get_plugin_srm_quark(), EBADMSG, __func__,
+                    "A turl can not start with /");
+            break;
+        }
+
+        // If error is set, skip the check
+        if ((*resu)[i].err_code != 0)
+            continue;
+
+        // Check the turl protocol is in the request list
+        int matching_protocol = 0;
+        for (j = 0; j < n_protocols; ++j) {
+            size_t proto_len = strlen(params->protocols[j]);
+            if (strncmp(params->protocols[j], turl, proto_len) == 0 && turl[proto_len] == ':') {
+                matching_protocol = 1;
+                break;
+            }
+        }
+
+        // If no matching protocol, fail already
+        if (!matching_protocol) {
+            failed = -1;
+            gfal2_set_error(tmp_err, gfal2_get_plugin_srm_quark(), EBADMSG, __func__,
+                    "The SRM endpoint returned a protocol that wasn't requested: %s");
+        }
+    }
+    // Didn't match, so free and set an error
+    if (failed) {
+        free(*resu);
+        *resu = NULL;
+    }
+    return failed;
+}
+
+
 static int gfal_srm_convert_filestatuses_to_srm_result(struct srmv2_pinfilestatus* statuses, char* reqtoken, int n, gfal_srm_result** resu, GError** err){
 	g_return_val_err_if_fail(statuses && n && resu, -1, err, "[gfal_srm_convert_filestatuses_to_srm_result] args invalids");
 	*resu = calloc(n, sizeof(gfal_srm_result));
@@ -167,8 +222,16 @@ static int gfal_srm_mTURLS_internal(gfal_srmv2_opt* opts, gfal_srm_params_t para
             ret = gfal_srm_putTURLS_srmv2_internal(context, opts, params, surls, resu, &tmp_err);
     }
 
-    if (ret < 0)
+    if (ret < 0) {
         gfal2_propagate_prefixed_error(err, tmp_err, __func__);
+    }
+    else {
+        int n_results = g_strv_length(surls);
+        if (validate_turls(n_results, resu, params, &tmp_err)) {
+            gfal2_propagate_prefixed_error(err, tmp_err, __func__);
+            ret = -1;
+        }
+    }
 
     return ret;
 }
@@ -232,9 +295,6 @@ int gfal_srm_getTURL_checksum(plugin_handle ch, const char* surl, char* buff_tur
     G_RETURN_ERR(ret, tmp_err, err);
 }
 
-
-
-
 //  execute a get for thirdparty transfer turl
 int gfal_srm_get_rd3_turl(plugin_handle ch, gfalt_params_t p, const char* surl,
         char* buff_turl, int size_turl,