[java-identity-provider] 01/02: Revert "IDP-2275 - Remediate use of UriComponentsBuilder in CAS implementation"

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
https://codeberg.org/Shibboleth/java-identity-provider/commit/cfae4cc47778b73fbfdd58fa528a90b38f0a21f5

commit cfae4cc47778b73fbfdd58fa528a90b38f0a21f5
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 8 11:54:54 2026 -0500

    Revert "IDP-2275 - Remediate use of UriComponentsBuilder in CAS implementation"
    
    This reverts commit 11d92c77a1d0d5d834fd7a94d655c66ec5b40358.
---
 .../idp/cas/protocol/ServiceTicketResponse.java      | 20 ++++++++------------
 idp-cas-impl/pom.xml                                 |  4 ----
 .../shibboleth/idp/test/flows/cas/LoginFlowTest.java |  4 ++--
 3 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
index 35cdf3ee5..23dcc00cf 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
@@ -14,13 +14,11 @@
 
 package net.shibboleth.idp.cas.protocol;
 
-import java.net.MalformedURLException;
-
 import javax.annotation.Nonnull;
 
-import net.shibboleth.shared.collection.Pair;
+import org.springframework.web.util.UriComponentsBuilder;
+
 import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.net.URLBuilder;
 
 /**
  * CAS protocol response message for a successfully granted service ticket.
@@ -28,7 +26,6 @@ import net.shibboleth.shared.net.URLBuilder;
  * @author Marvin S. Addison
  */
 public class ServiceTicketResponse {
-    
     /** Service URL. */
     @Nonnull private final String serviceURL;
 
@@ -108,13 +105,12 @@ public class ServiceTicketResponse {
      * @return URL that may be used to redirect to a service with a granted ticket
      */
     @Nonnull public String getRedirectUrl() {
-        try {
-            final URLBuilder builder = new URLBuilder(serviceURL);
-            builder.getQueryParams().add(new Pair<>(getTicketParameterName(), serviceTicket));
-            return builder.buildURL();
-        } catch (final MalformedURLException e) {
-            throw new IllegalArgumentException(e);
-        }
+        // TODO: Get this call out of here, Spring has patched it 3 times and counting.
+        // If the original call doesn't even check for duplicate parameter names in the original URL
+        // I doubt this is even bulletproof, though I don't know the CAS spec enough to say.
+        final UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(serviceURL);
+        builder.queryParam(getTicketParameterName(), serviceTicket);
+        return builder.build().toUriString();
     }
 
 }
\ No newline at end of file
diff --git a/idp-cas-impl/pom.xml b/idp-cas-impl/pom.xml
index ad7abffcd..9ad8860f5 100644
--- a/idp-cas-impl/pom.xml
+++ b/idp-cas-impl/pom.xml
@@ -95,10 +95,6 @@
             <artifactId>opensaml-xmlsec-api</artifactId>
         </dependency>
 
-        <dependency>
-            <groupId>${shib-shared.groupId}</groupId>
-            <artifactId>shib-networking</artifactId>
-        </dependency>
         <dependency>
             <groupId>${shib-shared.groupId}</groupId>
             <artifactId>shib-security</artifactId>
diff --git a/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java b/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
index 75b205069..8f66c83a7 100644
--- a/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
+++ b/idp-conf-impl/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
@@ -105,7 +105,7 @@ public class LoginFlowTest extends AbstractFlowTest {
 
         assertEquals(result.getOutcome().getId(), "RedirectToService");
         final String url = externalContext.getExternalRedirectUrl();
-        assertTrue(url.startsWith(service + "?ticket=ST-"));
+        assertTrue(url.contains(service + "?ticket=ST-"));
     }
 
     @Test
@@ -138,7 +138,7 @@ public class LoginFlowTest extends AbstractFlowTest {
         final FlowExecutionOutcome outcome = result.getOutcome();
         assertEquals(outcome.getId(), "RedirectToService");
         final String url = externalContext.getExternalRedirectUrl();
-        assertTrue(url.startsWith(service + "?ticket=ST-"));
+        assertTrue(url.contains(service + "?ticket=ST-"));
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.