[java-identity-provider] branch main updated: Add disabled test for semicolon in URL.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=296a93b36557da4e5dfcd3e3fe14729bc9b41868

The following commit(s) were added to refs/heads/main by this push:
     new 296a93b36 Add disabled test for semicolon in URL.
296a93b36 is described below

commit 296a93b36557da4e5dfcd3e3fe14729bc9b41868
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Mar 25 13:45:57 2025 -0400

    Add disabled test for semicolon in URL.
---
 .../idp/test/flows/cas/LoginFlowTest.java          | 56 ++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java b/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
index 62ae0b9d7..c0a976809 100644
--- a/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
+++ b/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
@@ -140,6 +140,62 @@ public class LoginFlowTest extends AbstractFlowTest {
         assertTrue(url.startsWith(service + "?ticket=ST-"));
     }
 
+    @Test
+    public void testLoginWithURL1() throws Exception {
+        final String service = "https://sso.example.org/?foo=bar";
+        externalContext.getMockRequestParameterMap().put("service", service);
+        overrideEndStateOutput(FLOW_ID, "RedirectToService");
+
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        final FlowExecutionOutcome outcome = result.getOutcome();
+        assertEquals(outcome.getId(), "RedirectToService");
+        
+        final String url = externalContext.getExternalRedirectUrl();
+        assertTrue(url.startsWith(service + "&ticket=ST-"));
+    }
+
+    /**
+     * This test would pass in the original implementation because Spring's URI parser
+     * leaves the existing parameter content unmolested and doesn't encode the ; or =
+     * characters inside the JSESSIONID suffix.
+     * 
+     * It's not obvious that's desired or useful anyway because leaving JSESSIONID "inside"
+     * the foo parameter's value likely wouldn't work anyway, anymore than our changed code
+     * (which encodes the two characters in the value) does.
+     * 
+     * I think this could only "work" by special casing it in the CAS code to detect and
+     * pull off JSESSIONID (or any other separated content) and re-appending it to the URL
+     * after adding the ticker parameter.
+     */
+    @Test(enabled=false)
+    public void testLoginWithURL2() throws Exception {
+        final String service = "https://sso.example.org/?foo=bar;JSESSIONID=123456789";
+        externalContext.getMockRequestParameterMap().put("service", service);
+        overrideEndStateOutput(FLOW_ID, "RedirectToService");
+
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        final FlowExecutionOutcome outcome = result.getOutcome();
+        assertEquals(outcome.getId(), "RedirectToService");
+        
+        final String url = externalContext.getExternalRedirectUrl();
+        assertTrue(url.startsWith(service + "&ticket=ST-"));
+    }
+
+    @Test
+    public void testLoginWithExistingTicketParam() throws Exception {
+        // Notably, this seems like a pretty broken idea, but the old code allowed it, so....
+        final String service = "https://sso.example.org/?ticket=zorkmid";
+        externalContext.getMockRequestParameterMap().put("service", service);
+        overrideEndStateOutput(FLOW_ID, "RedirectToService");
+
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        final FlowExecutionOutcome outcome = result.getOutcome();
+        assertEquals(outcome.getId(), "RedirectToService");
+        
+        final String url = externalContext.getExternalRedirectUrl();
+        assertTrue(url.startsWith(service + "&ticket=ST-"));
+    }
+
     @Test
     public void testLoginStartSession() throws Exception {
         // The service below is registered for single logout,

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.