Overanxious HTTP encoding is conflicting with URLEncoding

Basics

Logistics

Basics

Logistics

Description

This will take some time to track down but the symptom is easy to see.

On approach:

http://localhost:8080/discovery/uk.ds?entityID=https%3A%2F%2Fsh2testsp1.iay.org.uk%2Fshibboleth&return=https%3A%2F%2Fsh2testsp1.iay.org.uk%2FShibboleth.sso%2FUKfedDS%3FSAMLDS%3D1%26target%3Dcookie%253Abe2ba13e

Notice the return:

return=https%3A%2F%2Fsh2testsp1.iay.org.uk%2FShibboleth.sso%2FUKfedDS%3FSAMLDS%3D1%26target%3Dcookie%253Abe2ba13e

Which is for https://sh2testsp1.iay.org.uk/Shibboleth.sso/UKfedDS?SAMLDS=1&target=cookie%3Abe2ba13e

But after the user interaction:

http://localhost:8080/discovery/uk.ds?entityID=https%3A%2F%2Fsh2testsp1.iay.org.uk%2Fshibboleth&returnX=https%3A%2F%2Fsh2testsp1.iay.org.uk%2FShibboleth.sso%2FUKfedDS%3FSAMLDS%3D1%26amp%3Btarget%3Dcookie%253Abe2ba13e&returnIDParam=entityID&FedSelector=ALL&action=selection&origin=https%3A%2F%2Fidp2.iay.org.uk%2Fidp%2Fshibboleth&cache=perm

Look what returnX is. Where did that & come from?

So of course we send back to the SP as

https://sh2testsp1.iay.org.uk/Shibboleth.sso/UKfedDS?SAMLDS=1&target=cookie%3Abe2ba13e&entityID=https%3A%2F%2Fidp2.iay.org.uk%2Fidp%2Fshibboleth

Environment

None

Activity

Rod Widdowson

March 24, 2012 at 4:15 PM

It turns out that the problem is one of double encoding, <bean:write> does "some sort" of encoding and I added more.

Rather than trust to <bean> we put our faith in OWASP/ESAPI so now we render the beans using toString() and warp that in an explicit encodeForHTMLXXX (with the except of encodeForHTMLURL because there is no support for that in OpenSAML right now.

While I was added I added belt and braces check against non http/https URLs in the returnParam paramter (although is is already tested against a white list)

r2221 carried the

Resize issue view side panel

Fixed

Details

Assignee

Rod Widdowson

Reporter

Rod Widdowson

Original estimate

Fix versions

1.2.1

Affects versions

1.2

Created March 22, 2012 at 8:15 AM

Updated March 24, 2012 at 4:15 PM

Resolved March 24, 2012 at 4:15 PM

Overanxious HTTP encoding is conflicting with URLEncoding

Description

Environment

Activity

Details

Assignee

Reporter

Original estimate

Fix versions

Affects versions

Flag notifications

Something's gone wrong

Something's gone wrong