[JIRA] Commented: (SIDP-556) URLs in idpui included metadata on login page contain quoted characters

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SIDP-556?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14337#comment-14337 ] 

Scott Cantor commented on SIDP-556:
-----------------------------------

There's no way that's RFC-invalid, entities are perfectly legal characters in HTML.

That kind of encoding is what you get when you're being defensive with XSS issues. If that's what the OWASP library is generating, I'd have to say it would be pretty questionable of us to second-guess them.

> URLs in idpui included metadata on login page contain quoted characters
> -----------------------------------------------------------------------
>
>                 Key: SIDP-556
>                 URL: https://issues.shibboleth.net/jira/browse/SIDP-556
>             Project: Shibboleth IdP 2 - Java
>          Issue Type: Bug
>    Affects Versions: 2.3.8
>            Reporter: 8tnwj7yfxaxk5p0063ramfsn2ao=@urn:mace:ac.uk:sdss.ac.uk:provider:identity:dur.ac.uk
>            Assignee: Chad La Joie
>            Priority: Minor
>
> When an IDP login page includes idpui metadata certain characters are quoted, which includes / and : . Unfortunately this scrambles included URLs which means the URL for the included image ends up looking like
> src="https://shibboleth.net/images/gryphon_64x82.png"
> in the image tag
> I suspect this breaks the html RFC, though most browsers seem to cope with it. Seamonkey however doesn't and the image isn't shown.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira