[DS] encoding of target parameter

[Philip Brusten]

Hi,

I think there is a problem with the encoding of the returnX parameter in
the Shibboleth centralized discovery service.

I have a situation where I pass the target parameter 'by value' instead
of a cookie. (no relayState parameter in the SessionInitiator)

The protected resource has several query string parameter, e.g.:
https://sp.example.com/secure/index.php?key1=value1&key2=value2
The SessionInitiator is set to go to our central discovery service,
where the user will select his/her insitution. Next the user's browser
is pointed to:

GET
https://ds.example.com/DS/WAYF?entityID=https%3A%2F%2Fsp.example.com&returnX=https%3A%2F%2Fsp.example.com%2FShibboleth.sso%2FDS%3FSAMLDS%3D1%26target%3Dhttps%253A%252F%252Fsp.example.com%252Fsecure%252Findex.php%253Fkey1%253Dvalue1%2526key2%253Dvalue2%26forceAuthn%3Dfalse&returnIDParam=entityID&FedSelector=ALL&action=selection&origin=https%3A%2F%2Fidp.example.com&cache=session
HTTP/1.1

The returnX parameter is correctly URLencoded I believe, because the
'target' parameter is encoded twice, which seems good.
But in response to the above request, the browser is redirected to:

Location:
https://sp.example.com/Shibboleth.sso/DS?SAMLDS=1&target=https://sp.example.com/secure/index.php?key1=value1&key2=value2&forceAuthn=false&entityID=https%3A%2F%2Fidp.example.com

The target parameter is now *entirely* decoded and as a consequence the
second query string parameter (and more if present) is passed to the
first URL and isn't part of the target query string parameter anymore...

I created a little test script which decodes the value of the returnX
parameter:

String URL =
"https%3A%2F%2Fsp.example.com%2FShibboleth.sso%2FDS%3FSAMLDS%3D1%26target%3Dhttps%253A%252F%252Fsp.example.com%252Fsecure%252Findex.php%253Fkey1%253Dvalue1%2526key2%253Dvalue2%26forceAuthn%3Dfalse";
        try {
            URL=URLDecoder.decode(URL, "UTF-8");
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        }
        System.out.println(URL);

This results in:
https://sp.example.com/Shibboleth.sso/DS?SAMLDS=1&target=https%3A%2F%2Fsp.example.com%2Fsecure%2Findex.php%3Fkey1%3Dvalue1%26key2%3Dvalue2&forceAuthn=false

So I believe that for some reason the DS has decoded the returnX
parameter twice.

If someone could confirm this I shall file a bug.

Kr,

Philip



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5640 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/dev/attachments/20111208/4eb55a49/attachment.bin