[java-identity-provider] branch main updated: IDP-2275 - Remediate use of UriComponentsBuilder in CAS implementation

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=11d92c77a1d0d5d834fd7a94d655c66ec5b40358

The following commit(s) were added to refs/heads/main by this push:
     new 11d92c77a IDP-2275 - Remediate use of UriComponentsBuilder in CAS implementation
11d92c77a is described below

commit 11d92c77a1d0d5d834fd7a94d655c66ec5b40358
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Mar 25 12:19:18 2025 -0400

    IDP-2275 - Remediate use of UriComponentsBuilder in CAS implementation
    
    https://shibboleth.atlassian.net/browse/IDP-2275
    
    Converted to use our existing URLBuilder class.
---
 .../idp/cas/protocol/ServiceTicketResponse.java      | 20 ++++++++++++--------
 idp-cas-impl/pom.xml                                 |  4 ++++
 .../shibboleth/idp/test/flows/cas/LoginFlowTest.java |  4 ++--
 3 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
index 4f2b9ef39..f7bb4609e 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
@@ -14,11 +14,13 @@
 
 package net.shibboleth.idp.cas.protocol;
 
-import javax.annotation.Nonnull;
+import java.net.MalformedURLException;
 
-import org.springframework.web.util.UriComponentsBuilder;
+import javax.annotation.Nonnull;
 
+import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.net.URLBuilder;
 
 /**
  * CAS protocol response message for a successfully granted service ticket.
@@ -26,6 +28,7 @@ import net.shibboleth.shared.logic.Constraint;
  * @author Marvin S. Addison
  */
 public class ServiceTicketResponse {
+    
     /** Service URL. */
     @Nonnull private final String serviceURL;
 
@@ -105,12 +108,13 @@ public class ServiceTicketResponse {
      * @return URL that may be used to redirect to a service with a granted ticket
      */
     @Nonnull public String getRedirectUrl() {
-        // TODO: Get this call out of here, Spring has patched it 3 times and counting.
-        // If the original call doesn't even check for duplicate parameter names in the original URL
-        // I doubt this is even bulletproof, though I don't know the CAS spec enough to say.
-        final UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(serviceURL);
-        builder.queryParam(getTicketParameterName(), serviceTicket);
-        return builder.build().toUriString();
+        try {
+            final URLBuilder builder = new URLBuilder(serviceURL);
+            builder.getQueryParams().add(new Pair<>(getTicketParameterName(), serviceTicket));
+            return builder.buildURL();
+        } catch (final MalformedURLException e) {
+            throw new IllegalArgumentException(e);
+        }
     }
 
 }
\ No newline at end of file
diff --git a/idp-cas-impl/pom.xml b/idp-cas-impl/pom.xml
index 2a2aaf394..9c3ec79ec 100644
--- a/idp-cas-impl/pom.xml
+++ b/idp-cas-impl/pom.xml
@@ -95,6 +95,10 @@
             <artifactId>opensaml-xmlsec-api</artifactId>
         </dependency>
 
+        <dependency>
+            <groupId>${shib-shared.groupId}</groupId>
+            <artifactId>shib-networking</artifactId>
+        </dependency>
         <dependency>
             <groupId>${shib-shared.groupId}</groupId>
             <artifactId>shib-security</artifactId>
diff --git a/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java b/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
index 53e3ecac4..62ae0b9d7 100644
--- a/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
+++ b/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
@@ -104,7 +104,7 @@ public class LoginFlowTest extends AbstractFlowTest {
 
         assertEquals(result.getOutcome().getId(), "RedirectToService");
         final String url = externalContext.getExternalRedirectUrl();
-        assertTrue(url.contains(service + "?ticket=ST-"));
+        assertTrue(url.startsWith(service + "?ticket=ST-"));
     }
 
     @Test
@@ -137,7 +137,7 @@ public class LoginFlowTest extends AbstractFlowTest {
         final FlowExecutionOutcome outcome = result.getOutcome();
         assertEquals(outcome.getId(), "RedirectToService");
         final String url = externalContext.getExternalRedirectUrl();
-        assertTrue(url.contains(service + "?ticket=ST-"));
+        assertTrue(url.startsWith(service + "?ticket=ST-"));
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.