missing URL-encoding in audit log

[Andrew Morgan]

On Tue, 25 Jul 2017, Cantor, Scott wrote:

> On 7/25/17, 12:30 PM, "users on behalf of Andrew Morgan" <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:
>
>> I've read RFC 2396 (section 2.4.3).  I'm not clear if the CAS service URL
>> represented in the audit logs should be in an escaped form or not.  Is the
>> log representing a "URI" or something else in that context?
>
> It's a URI, expressed literally, as a name. If the URI contains 
> characters that have to be escaped to appear *in* the URI itself in one 
> of the segments, then it has to be escaped by the thing creating the 
> URI.
>
>> If it is a URI, then I propose that it should be URI escaped and the |
>> would be represented as %7C (thanks for the correction).
>
> Not by the IdP, no. The bug is in whatever is sending you that URI 
> without encoding the character.
>
> If the IdP encoded URI names, then SAML entityIDs would show up with 
> encoded / or : characters.

Here is the original Apache log entry from the client's web browser:

[23/Jul/2017:14:08:10 -0700] "GET /idp/profile/cas/login?service=https%3A%2F%2Fcourses.ecampus.oregonstate.edu%2Ffishes-collection%2Fimage.php%3Fid%3D1038%7CisIframe HTTP/1.1" 302 398

and the validation call from the CAS client:

[23/Jul/2017:14:08:35 -0700] "POST /cas/samlValidate?TARGET=https%3A%2F%2Fcourses.ecampus.oregonstate.edu%2Ffishes-collection%2Fimage.php%3Fid%3D1038%7CisIframe HTTP/1.1" 200 11906

I'm not sure what the browser or CAS client could do differently.  The 
service and TARGET parameters are URL-encoded, right?

Thanks,
 	Andy