OpenIDC / mod_auth_openidc

OpenID Certified™ OpenID Connect Relying Party implementation for Apache HTTP Server 2.x
Apache License 2.0
990 stars 327 forks source link

OIDCPreservePost not preserving newlines in POST data for textarea input fields #918

Closed jansmets closed 2 years ago

jansmets commented 2 years ago

Discussed in https://github.com/zmartzone/mod_auth_openidc/discussions/717

Originally posted by **jansmets** October 23, 2021 Hi! I'm trying to preserve POST data. The form has a textarea field. The submitted form data is "test test test test" During the redirection dance I see mod_auth_openidc_preserve_post_params => {"test":"test%0D%0Atest%0D%0Atest%0D%0Atest%0D%0A"} which looks good to me. (%0D%0A = CR LF) After authentication with the idp the browser goes back to the redirect_uri, and then finally the browser does a POST again to the original location. In that request I see "testtesttesttest" - which has the newlines removed. The Javascript used to replay the POST seems to be dropping that data. var input = document.createElement("input"); https://github.com/zmartzone/mod_auth_openidc/blob/master/src/mod_auth_openidc.c#L494 behaves differently and is only valid for input elements, not textarea's. For example: data="test%0D%0Atest%0D%0Atest%0D%0Atest%0D%0A" input = document.createElement("input"); input.value = decodeURIComponent(data) input.value => 'testtesttesttest' area = document.createElement("textarea") area.value = decodeURIComponent(data) area.value => 'test\ntest\ntest\ntest\n' I believe the element type also needs to be stored in the json data. Thank you
zandbelt commented 2 years ago

https://github.com/zmartzone/mod_auth_openidc/wiki#20-why-is-my-ticket-closed-as-invalid