how to decode/encode CAS tickets across HTTP requests ?

[Marvin Addison]

On Tue, Aug 30, 2016 at 11:57 AM Tom Zeller <tzeller at dragonacea.biz> wrote:

> Deal is, calling HttpServletRequest.getParameter() returns the latter (the
> wrong one with the “ “). What I need, I think, is a version of
> java-support’s URISupport.parseQueryString() which does not URL decode
> query string params, but I thought I’d ask first.
>

In short, the ticket string should be URL encoded so that decoding it
produces the original ticket ID. I will review tomorrow to determine
whether I got sloppy and missed an encoding call. I know that the servlet
framework does some encoding automatically, but I'll have to review to say
for sure what happens under what circumstances. In any case I'll try to add
some test coverage to ensure it's properly encoded.

The issue came up, I think, because the EncodingTicketService introduced
> characters into the ticket via the DataSealer that my horrible CAS “client”
> hadn’t seen before.
>

I _knew_ non-safe characters was going to cause problems, but I have to
admit I didn't do any careful analysis on exactly what those problems were.

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160830/f6b8d7f7/attachment.html>