[js-embedded-discovery] 01/02: EDS-70 EDS parameters in defaultReturn containing multiple = signs are ignored https://shibboleth.atlassian.net/browse/EDS-70

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository js-embedded-discovery.

View the commit online:
http://git.shibboleth.net/view/?p=js-embedded-discovery.git;a=commit;h=bcde9538b7870fcd41c3bbc47975c95cb5c57ee8

commit bcde9538b7870fcd41c3bbc47975c95cb5c57ee8
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon Jun 9 19:04:08 2025 +0100

    EDS-70 EDS parameters in defaultReturn containing multiple = signs are ignored
    https://shibboleth.atlassian.net/browse/EDS-70
    
    Apply patch
---
 src/javascript/idpselect.js | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/src/javascript/idpselect.js b/src/javascript/idpselect.js
index cf4f9c7..80e9071 100644
--- a/src/javascript/idpselect.js
+++ b/src/javascript/idpselect.js
@@ -263,6 +263,7 @@ function IdPSelectUI() {
         //
         var policy = 'urn:oasis:names:tc:SAML:profiles:SSO:idpdiscovery-protocol:single';
         var i;
+        var splitIndex;
         var isPassive = false;
         var parms;
         var parmPair;
@@ -303,10 +304,17 @@ function IdPSelectUI() {
             }
 
             for (i = 0; i < parms.length; i++) {
-                parmPair = parms[i].split('=');
-                if (parmPair.length != 2) {
-                    continue;
+                //
+                // Process url encoding parameters according to URL whatwg standard
+                //
+                splitIndex = parms[i].indexOf('=');
+                if (splitIndex < 0) {
+                    parmPair = [parms[i], ''];
+                } else {
+                    parmPair = [parms[i].substring(0, splitIndex), parms[i].substring(splitIndex+1)];
+
                 }
+
                 if (parmPair[0] == 'entityID') {
                     suppliedEntityId = decodeURIComponent(parmPair[1]);
                 } else if (parmPair[0] == 'return') {
@@ -404,10 +412,17 @@ function IdPSelectUI() {
         parmlist = returnString.substring(i+1);
         parms = parmlist.split('&');
         for (i = 0; i < parms.length; i++) {
-            parmPair = parms[i].split('=');
-            if (parmPair.length != 2) {
-                continue;
+            //
+            // Process url encoding parameters according to URL whatwg standard
+            //
+            splitIndex = parms[i].indexOf('=');
+            if (splitIndex < 0) {
+                parmPair = [parms[i], ''];
+            } else {
+                parmPair = [parms[i].substring(0, splitIndex), parms[i].substring(splitIndex+1)];
+
             }
+
             parmPair[1] = decodeURIComponent(parmPair[1]);
             returnParms.push(parmPair);
         }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.