missing URL-encoding in audit log

[Cantor, Scott]

On 7/25/17, 12:50 PM, "users on behalf of Andrew Morgan" <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:

> Here is the original Apache log entry from the client's web browser:

Yes, but the URL there is encoded, once, to make it a parameter. The problem is that the pipe character cannot (if that claim is correct) appear *unencoded* in a URL. That means after the IdP decodes the URL parameter, the unencoded URL should not have a pipe in it. The pipe has to be encoded once in the original URL. It would then be double-encoded when appearing in a parameter, and never appear once decoded by the web server.

> I'm not sure what the browser or CAS client could do differently.  The 
> service and TARGET parameters are URL-encoded, right?

Yes, but the decoded value contains an unsafe character. The CAS client isn't the problem, the thing generating an unsafe URL is the problem.

-- Scott