Ampersands being double-encoded, causing service not to validate

Description Of Problem:

In CAS_Client::getURL(), the url parameters are obtained via $_SERVER['REQUEST_URI'] which gives ampersands in the html form: &

This is then passed to urlencode() in CAS_Client::getServerLoginURL(), which encodes the ampersand as %26amp%3B.

These two facts cause the service url to be malformed in the following ways: - The ticket number is not properly removed from the URL in CAS_Client::getURL(), because the regex to replace it looks specifically for &ticket, not &ticket. - If there are multiple parameters, they also have & (and, in the end %26amp%3B), causing the services not to match the service of the ticket. That, in turn, causes an authentication exception.

Proposed Fix:

Calling html_entity_decode() on $_SERVER['REQUEST_URI'] in phpCAS::getURL() resolves the problem, and it doesn't seem to create any new ones, as far as I can tell, since it would still be passed to urlencode() before use, anyway, and if the problem doesn't exist on a particular system, the call to html_entity_decode() would not do anything.

Versions Affected:

I have tested this on ubuntu server and centos 6, both of which are affected by this bug. Both have the latest pear install of this code: version 1.3.2.

Relevant Logs:

NOTE: I added backslashes to the logs so that it would display properly here on github. They are not there in the original log. Initial redirect is in the 4D07 section, error occurs when checking the url in the C350 section. 4D07 .START phpCAS-1.3.2 *** [CAS.php:450] 4D07 .=> phpCAS::client('2.0', 'cas-test.ucdavis.edu', 443, 'cas') [index.php:53] 4D07 .| => CAS_Client::__construct('2.0', false, 'cas-test.ucdavis.edu', 443, 'cas', true) [CAS.php:347] 4D07 .| | Starting a new session [Client.php:792] 4D07 .| <= '' 4D07 .<= '' 4D07 .=> phpCAS::setNoCasServerValidation() [index.php:58] 4D07 .| You have configured no validation of the legitimacy of the cas server. This is not recommended for production use. [CAS.php:1669] 4D07 .<= '' 4D07 .=> phpCAS::forceAuthentication() [customer.php:19] 4D07 .| => CAS_Client::forceAuthentication() [CAS.php:1101] 4D07 .| | => CAS_Client::isAuthenticated() [Client.php:1083] 4D07 .| | | => CAS_Client::_wasPreviouslyAuthenticated() [Client.php:1189] 4D07 .| | | | no user found [Client.php:1375] 4D07 .| | | <= false 4D07 .| | | no ticket found [Client.php:1258] 4D07 .| | <= false 4D07 .| | => CAS_Client::redirectToCas(false) [Client.php:1092] 4D07 .| | | => CAS_Client::getServerLoginURL(false, false) [Client.php:1396] 4D07 .| | | | => CAS_Client::getURL() [Client.php:328] 4D07 .| | | | | Final URI: http://localhost/index.php?route=checkout/cart [Client.php:3071] 4D07 .| | | | <= 'http://localhost/index.php?route=checkout/cart' 4D07 .| | | <= 'https://cas-test.ucdavis.edu/cas/login?service=http%3A%2F%2Flocalhost%2Findex.php%3Froute%3Dcheckout%2Fcart' 4D07 .| | | Redirect to : https://cas-test.ucdavis.edu/cas/login?service=http%3A%2F%2Flocalhost%2Findex.php%3Froute%3Dcheckout%2Fcart [Client.php:1402] 4D07 .| | | exit() 4D07 .| | | - 4D07 .| | - 4D07 .| - C350 .START phpCAS-1.3.2 *** [CAS.php:450] C350 .=> phpCAS::client('2.0', 'cas-test.ucdavis.edu', 443, 'cas') [index.php:53] C350 .| => CAS_Client::__construct('2.0', false, 'cas-test.ucdavis.edu', 443, 'cas', true) [CAS.php:347] C350 .| | Starting a new session [Client.php:792] C350 .| | Ticket 'ST-1061-LOeHa6Yppge2z6g1gceP-fred' found [Client.php:870] C350 .| <= '' C350 .<= '' C350 .=> phpCAS::setNoCasServerValidation() [index.php:58] C350 .| You have configured no validation of the legitimacy of the cas server. This is not recommended for production use. [CAS.php:1669] C350 .<= '' C350 .=> phpCAS::forceAuthentication() [customer.php:19] C350 .| => CAS_Client::forceAuthentication() [CAS.php:1101] C350 .| | => CAS_Client::isAuthenticated() [Client.php:1083] C350 .| | | => CAS_Client::_wasPreviouslyAuthenticated() [Client.php:1189] C350 .| | | | no user found [Client.php:1375] C350 .| | | <= false C350 .| | | CAS 2.0 ticket `ST-1061-LOeHa6Yppge2z6g1gceP-fred' is present [Client.php:1223] C350 .| | | => CAS_Client::validateCAS20('', NULL, NULL) [Client.php:1224] C350 .| | | | [Client.php:2747] C350 .| | | | => CAS_Client::getServerServiceValidateURL() [Client.php:2753] C350 .| | | | | => CAS_Client::getURL() [Client.php:417] C350 .| | | | | | Final URI: http://localhost/index.php?route=checkout/cart&ticket=ST-1061-LOeHa6Yppge2z6g1gceP-fred [Client.php:3071] C350 .| | | | | <= 'http://localhost/index.php?route=checkout/cart&ticket=ST-1061-LOeHa6Yppge2z6g1gceP-fred' C350 .| | | | <= 'https://cas-test.ucdavis.edu/cas/serviceValidate?service=http%3A%2F%2Flocalhost%2Findex.php%3Froute%3Dcheckout%2Fcart%26amp%3Bticket%3DST-1061-LOeHa6Yppge2z6g1gceP-fred' C350 .| | | | => CAS_Client::_readURL('https://cas-test.ucdavis.edu/cas/serviceValidate?service=http%3A%2F%2Flocalhost%2Findex.php%3Froute%3Dcheckout%2Fcart%26amp%3Bticket%3DST-1061-LOeHa6Yppge2z6g1gceP-fred&ticket=ST-1061-LOeHa6Yppge2z6g1gceP-fred', NULL, NULL, NULL) [Client.php:2762] C350 .| | | | | => CAS_Request_CurlRequest::sendRequest() [AbstractRequest.php:220] C350 .| | | | | | Response Body: C350 .| | | | | |
C350 .| | | | | |
C350 .| | | | | |
C350 .| | | | | | C350 .| | | | | | C350 .| | | | | | ticket 'ST-1061-LOeHa6Yppge2z6g1gceP-fred' does not match supplied service. The original service was 'http://localhost/index.php?route=checkout/cart' and the supplied service was 'http://localhost/index.php?route=checkout/cart&ticket=ST-1061-LOeHa6Yppge2z6g1gceP-fred'. C350 .| | | | | | /cas:authenticationFailure C350 .| | | | | | /cas:serviceResponse C350 .| | | | | | [CurlRequest.php:82] C350 .| | | | | <= true C350 .| | | | <= true C350 .| | | | => CAS_AuthenticationException::__construct(CAS_Client, 'Ticket not validated', 'https://cas-test.ucdavis.edu/cas/serviceValidate?service=http%3A%2F%2Flocalhost%2Findex.php%3Froute%3Dcheckout%2Fcart%26amp%3Bticket%3DST-1061-LOeHa6Yppge2z6g1gceP-fred&ticket=ST-1061-LOeHa6Yppge2z6g1gceP-fred', false, false, ' ticket 'ST-1061-LOeHa6Yppge2z6g1gceP-fred' does not match supplied service. The original service was 'http://localhost/index.php?route=checkout/cart' and the supplied service was 'http://localhost/index.php?route=checkout/car\t&ticket=ST-1061-LOeHa6Yppge2z6g1gceP-fred'. /cas:authenticationFailure/cas:serviceResponse', 'INVALID_SERVICE', 'ticket \'ST-1061-LOeHa6Yppge2z6g1gceP-fred\' does not match supplied service. The original service was \'http://localhost/index.php?route=checkout/cart\' and the supplied service was \'http://localhost/index.php?route=checkout/cart&ticket=ST-1061-LOeHa6Yppge2z6g1gceP-fred\'.') [Client.php:2845] C350 .| | | | | => CAS_Client::getURL() [AuthenticationException.php:76] C350 .| | | | | <= 'http://localhost/index.php?route=checkout/cart&ticket=ST-1061-LOeHa6Yppge2z6g1gceP-fred' C350 .| | | | | CAS URL: https://cas-test.ucdavis.edu/cas/serviceValidate?service=http%3A%2F%2Flocalhost%2Findex.php%3Froute%3Dcheckout%2Fcart%26amp%3Bticket%3DST-1061-LOeHa6Yppge2z6g1gceP-fred&ticket=ST-1061-LOeHa6Yppge2z6g1gceP-fred [AuthenticationException.php:79] C350 .| | | | | Authentication failure: Ticket not validated [AuthenticationException.php:80] C350 .| | | | | Reason: [INVALID_SERVICE] CAS error: ticket 'ST-1061-LOeHa6Yppge2z6g1gceP-fred' does not match supplied service. The original service was 'http://localhost/index.php?route=checkout/cart' and the supplied service was 'http://localhost/index.php?route=checkout/cart&ticket=ST-1061-LOeHa6Yppge2z6g1gceP-fred'. [AuthenticationException.php:95] C350 .| | | | | CAS response: C350 .| | | | |
C350 .| | | | |
C350 .| | | | | C350 .| | | | | C350 .| | | | | ticket 'ST-1061-LOeHa6Yppge2z6g1gceP-fred' does not match supplied service. The original service was 'http://localhost/index.php?route=checkout/cart' and the supplied service was 'http://localhost/index.php?route=checkout/cart&ticket=ST-1061-LOeHa6Yppge2z6g1gceP-fred'. C350 .| | | | | /cas:authenticationFailure C350 .| | | | | /cas:serviceResponse [AuthenticationException.php:100] C350 .| | | | | exit() C350 .| | | | | - C350 .| | | | - C350 .| | | - C350 .| | - .| -

该提问来源于开源项目：apereo/phpCAS

写回答
好问题 0 提建议
关注问题
分享
邀请回答
编辑收藏删除结题
收藏举报

报告相同问题？

关注问题

Unity HDRP 2022 Release-Notes
2024-04-16 12:49

牙膏上的小苏打2333的博客 56424) 2022.3.17 HDRP: Fixed Disk Light’s property not being updated when changing it’s radius using the gizmo in the scene.(UUM-51530) 2022.3.17 HDRP: Fixed exception thrown when running projects ...
12C ORA-错误汇总10 ORA-12500 to ORA-19400
2016-03-02 21:40

badman250的博客 ORA-12500: TNS:listener failed to start a dedicated server process Cause: The process of starting up a dedicated server process failed. The executable could not be found or the environment may be se
12C ORA-错误汇总14 ORA-29250 to ORA-32799
2016-03-02 21:46

badman250的博客 ORA-29250: Invalid index specifed in call to dbms_sql.bind_array Cause: An invalid index was specified in a call to bind_array of dbms_sql. The index may have been null or of an improper value. Act
sqoop-使用文档
2021-08-12 22:28

果不其燃的博客该项目已退役。详情请参阅其阁楼页面。文档主页 Sqoop 用户指南 (v1.4.7) Sqoop 用户指南 (v1.4.7) 目录一、简介 2. 支持的版本 3. Sqoop 发布 4. 先决条件 5. 基本用法 6. Sqoop 工具 ...7.2.2. 选择要导入
Hypertext Transfer Protocol -- HTTP/1.0
2021-07-16 15:05

yangbocsu的博客 A feature of HTTP is the typing of data representation, allowing systems to be built independently of the data being transferred. ...
Redis-7.0.x版本官方发行说明（附谷歌翻译）【持续更新】
2022-12-30 16:30

大白有点菜的博客 (CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. (CVE-2022-...
Puppeteer开发过程中遇到的问题及解决方案
2021-12-10 17:18

冷幽悠的博客 ↪ --additional-trust-token-key-commitments ⊗ Manually sets additional Trust Tokens key commitments in the network service to the given value, which should be a JSON dictionary satisfying the ...
Software Engineering at Google翻译-III-11-Testing overview（测试概述）
2022-03-16 18:40

rock.dai的博客 Team members had little confidence when making changes to the service, and often found out something was wrong only when features stopped working in production. (At one point, more than 80% of ...
16 ORA-29250 to ORA-32775
2010-06-29 00:31

firecityplans的博客 ORA-29250: Invalid index specifed in call to dbms_sql.bind_arrayCause: An invalid index was specified in a call to bind_array of dbms_sql. The index may have been null or of an improper value.Action: ...
“An ns-3 Implementation of a Bursty Traffic Framework for Virtual Reality Sources”学习笔记
2022-02-17 12:04

AlphaFinance的博客 Next-generation wireless communication technologies will allow users to obtain unprecedented performance, paving the way to new and immersive applications. A prominent application requiring high data ...
php - 发送qq邮箱信息
2019-03-07 15:52

倾听岁月的博客 * Set to 0 to not wrap. A useful value here is 78, for RFC2822 section 2.1.1 compliance. * * @see static::STD_LINE_LENGTH * * @var int */ public $WordWrap = 0; /** * Which method to use to ...
Vue v-bind指令
2018-12-29 17:08

mqingo的博客 // these helpers produces better vm code in JS engines due to their // explicitness and function inlining function isUndef (v) { return v === undefined || v === null } function isDef (v) { return v...
Hypertext Transfer Protocol -- HTTP/1.1
2018-06-12 10:05

weixin_33749131的博客 to be built independently of the data being transferred. HTTP has been in use by the World-Wide Web global information initiative since 1990. This specification defines the protocol referred to ...
Http1.1_1
2023-02-20 15:59

孤独斗士的博客 one that satisfies all the MUST level requirements but not all the SHOULD level requirements for its protocols is said to be "conditionally compliant." 1.3 Terminology This specification uses a ...
Vue v-model指令的学习
2019-01-02 09:43

mqingo的博客 // these helpers produces better vm code in JS engines due to their // explicitness and function inlining function isUndef (v) { return v === undefined || v === null } function isDef (v) { return v...
Vue v-on指令
2018-12-29 17:47

mqingo的博客 // these helpers produces better vm code in JS engines due to their // explicitness and function inlining function isUndef (v) { return v === undefined || v === null } function isDef (v) { return v...
Vue 10Vue中使用内联样式----style
2019-01-02 11:08

mqingo的博客 // these helpers produces better vm code in JS engines due to their // explicitness and function inlining function isUndef (v) { return v === undefined || v === null } function isDef (v) { return v...
Vue 09Vue中使用行内样式---class
2019-01-02 10:59

mqingo的博客 * Stubbing args to make Flow happy without leaving useless transpiled code * with ...rest (https://flow.org/blog/2017/05/07/Strict-Function-Call-Arity/) */ function noop (a, b, c) {} /** * Always...
没有解决我的问题, 去提问

码龄粉丝数原力等级 --

Ampersands being double-encoded, causing service not to validate

Description Of Problem:

Proposed Fix:

Versions Affected:

Relevant Logs:

0条回答默认最新

Ampersands being double-encoded, causing service not to validate

Description Of Problem:

Proposed Fix:

Versions Affected:

Relevant Logs:

0条回答 默认 最新

0条回答默认最新