[java-plugin-shibd] branch dev/StateMgmtWIP updated: Correct call to URL decode sealed data.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/StateMgmtWIP
in repository java-plugin-shibd.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd/commit/9e65597178c2889dbacf559ea61655e59afa34d6

The following commit(s) were added to refs/heads/dev/StateMgmtWIP by this push:
     new 9e65597  Correct call to URL decode sealed data.
9e65597 is described below

commit 9e65597178c2889dbacf559ea61655e59afa34d6
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Tue May 5 08:49:25 2026 -0400

    Correct call to URL decode sealed data.
---
 .../java/net/shibboleth/sp/state/impl/CookieStateManager.java     | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/state/impl/CookieStateManager.java b/sp-server-impl/src/main/java/net/shibboleth/sp/state/impl/CookieStateManager.java
index 5f22f61..29f9875 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/state/impl/CookieStateManager.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/state/impl/CookieStateManager.java
@@ -16,8 +16,6 @@ package net.shibboleth.sp.state.impl;
 
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
-import java.security.InvalidAlgorithmParameterException;
-import java.security.NoSuchAlgorithmException;
 import java.time.Instant;
 
 import javax.annotation.Nonnull;
@@ -35,11 +33,9 @@ import net.shibboleth.shared.codec.EncodingException;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.net.CookieManager;
+import net.shibboleth.shared.net.URISupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
-import net.shibboleth.shared.security.IdentifierGenerationStrategy;
-import net.shibboleth.shared.security.IdentifierGenerationStrategy.ProviderType;
-import net.shibboleth.shared.security.RandomIdentifierParameterSpec;
 import net.shibboleth.sp.Agent;
 import net.shibboleth.sp.Application;
 import net.shibboleth.sp.state.AbstractStateManager;
@@ -144,7 +140,7 @@ public class CookieStateManager extends AbstractStateManager {
 
             final String decoded;
             if (sealed) {
-                decoded = UrlEscapers.urlFormParameterEscaper().escape(cookieValue);
+                decoded = URISupport.doURLDecode(cookieValue);
             } else {
                 try {
                     decoded = new String(Base64Support.decodeURLSafe(cookieValue), StandardCharsets.UTF_8);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.