Do not decode URI for processing

wildfly-security · Oct 29, 2024 · bf310d2 · bf310d2
1 parent 7777573
commit bf310d2
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 7 deletions.
diff --git a/http/oidc/src/main/java/org/wildfly/security/http/oidc/OidcHttpFacade.java b/http/oidc/src/main/java/org/wildfly/security/http/oidc/OidcHttpFacade.java
@@ -29,7 +29,6 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
-import java.io.UnsupportedEncodingException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.URI;
@@ -205,11 +204,7 @@ public String getMethod() {
 
             @Override
             public String getURI() {
-                try {
-                    return URLDecoder.decode(request.getRequestURI().toString(), "UTF-8");
-                } catch (UnsupportedEncodingException e) {
-                    throw log.failedToDecodeRequestUri(e);
-                }
+                return request.getRequestURI().toString();
             }
 
             @Override
@@ -230,7 +225,7 @@ public String getFirstParam(String param) {
             @Override
             public String getQueryParamValue(String param) {
                 URI requestURI = request.getRequestURI();
-                String query = requestURI.getQuery();
+                String query = requestURI.getRawQuery();
                 if (query != null) {
                     String[] parameters = query.split("&");
                     for (String parameter : parameters) {

diff --git a/http/oidc/src/test/java/org/wildfly/security/http/oidc/QueryParamsEnabledTest.java b/http/oidc/src/test/java/org/wildfly/security/http/oidc/QueryParamsEnabledTest.java
@@ -79,6 +79,13 @@ public void testSuccessfulAuthenticationWithQueryParamsWithSystemPropertyEnabled
         performAuthentication(getOidcConfigurationInputStreamWithProviderUrl(), KeycloakConfiguration.ALICE,
                 KeycloakConfiguration.ALICE_PASSWORD, true, HttpStatus.SC_MOVED_TEMPORARILY, originalUrl,
                 expectedUrlAfterRedirect, CLIENT_PAGE_TEXT);
+
+        queryParams = "?url=http%3A%2F%2Flocalhost%2F%3Fone%3Dabc%26two%3Ddef&three=ghi";
+        originalUrl = getClientUrl() + queryParams;
+        expectedUrlAfterRedirect = originalUrl;
+        performAuthentication(getOidcConfigurationInputStreamWithProviderUrl(), KeycloakConfiguration.ALICE,
+                KeycloakConfiguration.ALICE_PASSWORD, true, HttpStatus.SC_MOVED_TEMPORARILY, originalUrl,
+                expectedUrlAfterRedirect, CLIENT_PAGE_TEXT);
     }
 
 }