POST binding URL now escaped, why?

[Chad La Joie]

It's magic.

As part of one of the security issues we went through and made sure
all the data we were putting in to HTML forms was probably encoded for
the particular HTML data structure that bore the information.  So,
what you're seeing is the proper encoding of a URL within an
attribute.  Assuming no other bugs or invalid data anywhere else in
the system that would not have been strictly but, obviously, thats
never a good assumption to make.

On Wed, Aug 31, 2011 at 09:01, Etienne Dysli <etienne.dysli at unil.ch> wrote:
> Hi all,
>
> One of our developers noticed that, going from IdP 2.2.1 to 2.3.3, the
> URL in the form action of the POST binding is now escaped: colons and
> slashes are replaced by entities &#x3a; and &#x2f; respectively. For
> example, https://sp.unil.ch/Shibboleth.sso/SAML2/POST becomes
> https&#x3a;&#x2f;&#x2f;sp.unil.ch&#x2f;Shibboleth.sso&#x2f;SAML2&#x2f;POST.
>
> I'm not (yet) claiming this is wrong but I'd like to know the cause of
> this change. From my investigation neither the template
> saml2-post-binding.vm nor the Velocity version (1.5) changed between IdP
> 2.2.1 and 2.3.3. So I'm left wondering why that happened...
>
> Regards,
>   Etienne
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered