[java-identity-provider COMMIT] in /trunk: idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketRes...

[noreply at shibboleth.net]

Author: serac
Date: Wed Aug 31 14:17:23 2016
New Revision: 8361

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8361&view=rev
Log:
IDP-1018 Percent encode tickets.

https://issues.shibboleth.net/jira/browse/IDP-1018
With EncodingTicketService tickets can contain characters ("+", "/", "=")
that need to be percent-encoded for proper handling by many HTTP libs.

Modified:
    trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowInitialAuthnTest.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java

Modified: trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java?rev=8361&r1=8360&r2=8361&view=diff
==============================================================================
--- trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java	(original)
+++ trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java	Wed Aug 31 14:17:23 2016
@@ -17,8 +17,14 @@
 
 package net.shibboleth.idp.cas.protocol;
 
+import java.net.MalformedURLException;
+
+import net.shibboleth.utilities.java.support.collection.Pair;
 import net.shibboleth.utilities.java.support.logic.Constraint;
-import org.springframework.web.util.UriComponentsBuilder;
+import net.shibboleth.utilities.java.support.net.URISupport;
+import net.shibboleth.utilities.java.support.net.URLBuilder;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import javax.annotation.Nonnull;
 
@@ -28,6 +34,9 @@
  * @author Marvin S. Addison
  */
 public class ServiceTicketResponse {
+    /** Logger. */
+    private final Logger logger = LoggerFactory.getLogger(ServiceTicketResponse.class);
+
     /** Service URL */
     @Nonnull
     private final String service;
@@ -81,8 +90,24 @@
      * @return URL that may be used to redirect to a service with a granted ticket.
      */
     public String getRedirectUrl() {
-        final UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(service);
-        builder.queryParam(getTicketParameterName(), ticket);
-        return builder.build().toUriString();
+        try {
+            final URLBuilder builder = new URLBuilder(service);
+            builder.getQueryParams().add(new Pair<>(getTicketParameterName(), ticket));
+            return builder.buildURL();
+        } catch (MalformedURLException e) {
+            if (logger.isDebugEnabled()) {
+                logger.debug("Error decoding URL {}", service, e);
+            } else {
+                logger.warn("Error decoding URL {}", service);
+            }
+            // Fall back to appending the ticket to service URL
+            final char sep;
+            if (service.indexOf('?') > -1) {
+                sep = '&';
+            } else {
+                sep = '?';
+            }
+            return service + sep + getTicketParameterName() + '=' + URISupport.doURLEncode(ticket);
+        }
     }
 }

Modified: trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowInitialAuthnTest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowInitialAuthnTest.java?rev=8361&r1=8360&r2=8361&view=diff
==============================================================================
--- trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowInitialAuthnTest.java	(original)
+++ trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowInitialAuthnTest.java	Wed Aug 31 14:17:23 2016
@@ -30,6 +30,7 @@
 import net.shibboleth.idp.session.criterion.SessionIdCriterion;
 import net.shibboleth.idp.session.impl.StorageBackedSessionManager;
 import net.shibboleth.idp.test.flows.AbstractFlowTest;
+import net.shibboleth.utilities.java.support.net.URISupport;
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
 
 import org.opensaml.profile.context.ProfileRequestContext;
@@ -83,7 +84,7 @@
         assertEquals(outcome.getId(), "RedirectToService");
         final String url = externalContext.getExternalRedirectUrl();
         assertTrue(url.contains("ticket=ST-"));
-        final String ticketId = url.substring(url.indexOf("ticket=") + 7);
+        final String ticketId = URISupport.doURLDecode(url.substring(url.indexOf("ticket=") + 7));
         final Ticket st = ticketService.removeServiceTicket(ticketId);
         assertNotNull(st);
         final IdPSession session = sessionManager.resolveSingle(

Modified: trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java?rev=8361&r1=8360&r2=8361&view=diff
==============================================================================

[... 69 lines stripped ...]