From 20ca96b35379c0198f93b5c3e7885c02c8a5c6a7 Mon Sep 17 00:00:00 2001
From: rmartinc <rmartinc@redhat.com>
Date: Wed, 29 Nov 2023 13:26:00 +0000
Subject: [PATCH] Revert "Fix lowerCaseHostname to lower-case scheme and host properly"
---
src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java | 9 +++++++--
1 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java b/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
index 7c9c475..b1bc4e3 100644
--- a/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
+++ b/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
@@ -107,6 +107,12 @@
logger.debug("No Redirect URIs supplied");
redirectUri = null;
} else {
+ URI originalRedirect = toUri(redirectUri);
+ if (originalRedirect == null) {
+ // invalid URI passed as redirectUri
+ return null;
+ }
+
// Make the validations against fully decoded and normalized redirect-url. This also allows wildcards (case when client configured "Valid redirect-urls" contain wildcards)
String decodedRedirectUri = decodeRedirectUri(redirectUri);
URI decodedRedirect = toUri(decodedRedirectUri);
@@ -135,8 +141,7 @@
}
// Return the original redirectUri, which can be partially encoded - for example http://localhost:8280/foo/bar%20bar%2092%2F72/3 . Just make sure it is normalized
- URI redirect = toUri(redirectUri);
- redirectUri = getNormalizedRedirectUri(redirect);
+ redirectUri = getNormalizedRedirectUri(originalRedirect);
// We try to check validity also for original (encoded) redirectUrl, but just in case it exactly matches some "Valid Redirect URL" specified for client (not wildcards allowed)
if (valid == null) {
--
Gitblit v1.10.0