[JIRA] Resolved: (SDSJ-109) Overanxious HTTP encoding is conflicting with URLEncoding

[Rod Widdowson (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SDSJ-109?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Rod Widdowson resolved SDSJ-109.
--------------------------------

    Resolution: Fixed

It turns out that the problem is one of double encoding, <bean:write> does "some sort" of encoding and I added more.

Rather than trust to <bean> we put our faith in OWASP/ESAPI so now we render the beans using toString() and warp that in an explicit encodeForHTMLXXX (with the except of encodeForHTMLURL because there is no support for that in OpenSAML right now.

While I was added I added belt and braces check against non http/https URLs in the returnParam paramter (although is is already tested against a white list)


r2221 carried the

> Overanxious HTTP encoding is conflicting with URLEncoding
> ---------------------------------------------------------
>
>                 Key: SDSJ-109
>                 URL: https://issues.shibboleth.net/jira/browse/SDSJ-109
>             Project: Shibboleth Discovery Service - Java
>          Issue Type: Bug
>    Affects Versions: 1.2
>            Reporter: Rod Widdowson
>            Assignee: Rod Widdowson
>             Fix For: 1.2.1
>
>   Original Estimate: 2 hours
>  Remaining Estimate: 2 hours
>
> This will take some time to track down but the symptom is easy to see.
> On approach:
> http://localhost:8080/discovery/uk.ds?entityID=https%3A%2F%2Fsh2testsp1.iay.org.uk%2Fshibboleth&return=https%3A%2F%2Fsh2testsp1.iay.org.uk%2FShibboleth.sso%2FUKfedDS%3FSAMLDS%3D1%26target%3Dcookie%253Abe2ba13e
> Notice the return:
> return=https%3A%2F%2Fsh2testsp1.iay.org.uk%2FShibboleth.sso%2FUKfedDS%3FSAMLDS%3D1%26target%3Dcookie%253Abe2ba13e
> Which is for https://sh2testsp1.iay.org.uk/Shibboleth.sso/UKfedDS?SAMLDS=1&target=cookie%3Abe2ba13e
> But after the user interaction:
> http://localhost:8080/discovery/uk.ds?entityID=https%3A%2F%2Fsh2testsp1.iay.org.uk%2Fshibboleth&returnX=https%3A%2F%2Fsh2testsp1.iay.org.uk%2FShibboleth.sso%2FUKfedDS%3FSAMLDS%3D1%26amp%3Btarget%3Dcookie%253Abe2ba13e&returnIDParam=entityID&FedSelector=ALL&action=selection&origin=https%3A%2F%2Fidp2.iay.org.uk%2Fidp%2Fshibboleth&cache=perm
> Look what returnX is.  Where did that &amp; come from?
> So of course we send back to the SP as
> https://sh2testsp1.iay.org.uk/Shibboleth.sso/UKfedDS?SAMLDS=1&amp;target=cookie%3Abe2ba13e&entityID=https%3A%2F%2Fidp2.iay.org.uk%2Fidp%2Fshibboleth

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira