[DS] encoding of target parameter

[Rod Widdowson]

> If someone could confirm this I shall file a bug.

If this occurs with 1.1.3 (which saw some changes with encoding), then please do not wait.  
This sounds like a real bug.

Rod

> -----Original Message-----
> From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Philip Brusten
> Sent: 08 December 2011 08:44
> To: dev at shibboleth.net
> Subject: [DS] encoding of target parameter
> 
> Hi,
> 
> I think there is a problem with the encoding of the returnX parameter in the Shibboleth centralized
> discovery service.
> 
> I have a situation where I pass the target parameter 'by value' instead of a cookie. (no relayState
> parameter in the SessionInitiator)
> 
> The protected resource has several query string parameter, e.g.:
> https://sp.example.com/secure/index.php?key1=value1&key2=value2
> The SessionInitiator is set to go to our central discovery service, where the user will select his/her
> insitution. Next the user's browser is pointed to:
> 
> GET
> https://ds.example.com/DS/WAYF?entityID=https%3A%2F%2Fsp.example.com&returnX=https%3A%2F%2Fsp.example.
> com%2FShibboleth.sso%2FDS%3FSAMLDS%3D1%26target%3Dhttps%253A%252F%252Fsp.example.com%252Fsecure%252Fin
> dex.php%253Fkey1%253Dvalue1%2526key2%253Dvalue2%26forceAuthn%3Dfalse&returnIDParam=entityID&FedSelecto
> r=ALL&action=selection&origin=https%3A%2F%2Fidp.example.com&cache=session
> HTTP/1.1
> 
> The returnX parameter is correctly URLencoded I believe, because the 'target' parameter is encoded
> twice, which seems good.
> But in response to the above request, the browser is redirected to:
> 
> Location:
> https://sp.example.com/Shibboleth.sso/DS?SAMLDS=1&target=https://sp.example.com/secure/index.php?key1=
> value1&key2=value2&forceAuthn=false&entityID=https%3A%2F%2Fidp.example.com
> 
> The target parameter is now *entirely* decoded and as a consequence the second query string parameter
> (and more if present) is passed to the first URL and isn't part of the target query string parameter
> anymore...
> 
> I created a little test script which decodes the value of the returnX
> parameter:
> 
> String URL =
> "https%3A%2F%2Fsp.example.com%2FShibboleth.sso%2FDS%3FSAMLDS%3D1%26target%3Dhttps%253A%252F%252Fsp.exa
> mple.com%252Fsecure%252Findex.php%253Fkey1%253Dvalue1%2526key2%253Dvalue2%26forceAuthn%3Dfalse";
>         try {
>             URL=URLDecoder.decode(URL, "UTF-8");
>         } catch (UnsupportedEncodingException e) {
>             e.printStackTrace();
>         }
>         System.out.println(URL);
> 
> This results in:
> https://sp.example.com/Shibboleth.sso/DS?SAMLDS=1&target=https%3A%2F%2Fsp.example.com%2Fsecure%2Findex
> .php%3Fkey1%3Dvalue1%26key2%3Dvalue2&forceAuthn=false
> 
> So I believe that for some reason the DS has decoded the returnX parameter twice.
> 
> If someone could confirm this I shall file a bug.
> 
> Kr,
> 
> Philip
> 
>