[java-identity-provider] branch main updated: Add a TODO to remediate Spring method.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=be413a23b84ec718d751652fd7c05d26fc634fba

The following commit(s) were added to refs/heads/main by this push:
     new be413a23b Add a TODO to remediate Spring method.
be413a23b is described below

commit be413a23b84ec718d751652fd7c05d26fc634fba
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 11 11:19:20 2024 -0400

    Add a TODO to remediate Spring method.
---
 .../java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java    | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
index 2ef272e11..4f2b9ef39 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
@@ -105,6 +105,9 @@ public class ServiceTicketResponse {
      * @return URL that may be used to redirect to a service with a granted ticket
      */
     @Nonnull public String getRedirectUrl() {
+        // TODO: Get this call out of here, Spring has patched it 3 times and counting.
+        // If the original call doesn't even check for duplicate parameter names in the original URL
+        // I doubt this is even bulletproof, though I don't know the CAS spec enough to say.
         final UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(serviceURL);
         builder.queryParam(getTicketParameterName(), serviceTicket);
         return builder.build().toUriString();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.