[JIRA] Commented: (SIDP-556) URLs in idpui included metadata on login page contain quoted characters

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SIDP-556?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14339#comment-14339 ] 

Scott Cantor commented on SIDP-556:
-----------------------------------

Somebody ought to tell OWASP then, but I don't think they'll be receptive to that line of thinking. In our context, you're asking us to stop encoding the URL and somehow still prevent XSS injection. I don't see how we can do that or why we'd want to use our own custom (and therefore probably wrong) encoder vs. using the OWASP one.

What standard are you reading? There's no RFC for HTML, so I assume you mean a W3C rec?

> URLs in idpui included metadata on login page contain quoted characters
> -----------------------------------------------------------------------
>
>                 Key: SIDP-556
>                 URL: https://issues.shibboleth.net/jira/browse/SIDP-556
>             Project: Shibboleth IdP 2 - Java
>          Issue Type: Bug
>    Affects Versions: 2.3.8
>            Reporter: 8tnwj7yfxaxk5p0063ramfsn2ao=@urn:mace:ac.uk:sdss.ac.uk:provider:identity:dur.ac.uk
>            Assignee: Chad La Joie
>            Priority: Minor
>
> When an IDP login page includes idpui metadata certain characters are quoted, which includes / and : . Unfortunately this scrambles included URLs which means the URL for the included image ends up looking like
> src="https://shibboleth.net/images/gryphon_64x82.png"
> in the image tag
> I suspect this breaks the html RFC, though most browsers seem to cope with it. Seamonkey however doesn't and the image isn't shown.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira