apereo / dotnet-cas-client

Apereo .NET CAS Client
Apache License 2.0
234 stars 172 forks source link

SingleSignOut causes A potentially dangerous Request.Form exception #81 #82

Closed nightBaker closed 6 years ago

nightBaker commented 6 years ago

80

After logout CAS sends post request message=@NOT_USED@</saml:NameID>ST-2171-iZF3BlhCp9VdarvPV-tJ1GEebO0-kaspi-portsso1</samlp:SessionIndex></samlp:LogoutRequest>,asynchronous=false,contentType=application/x-www-form-urlencoded

And dotnet-cas-client tryes get logoutRequest from HttpContext.Current.Request.Form

internal static void ProcessSingleSignOutRequest()
        {
            HttpContext context = HttpContext.Current;
            HttpRequest request = context.Request;
            HttpResponse response = context.Response;
            protoLogger.Debug("Examining request for single sign-out signature");

            if (request.HttpMethod == "POST" && request.Form["logoutRequest"] != null)
            {

getting value is causing exception - context.Request.Form["logoutRequest"] 'context.Request.Form["logoutRequest"]' threw an exception of type 'System.Web.HttpRequestValidationException' string {System.Web.HttpRequestValidationException}

phantomtypist commented 6 years ago
  1. I have to update the readme to remind contributors to PR against the develop branch, not master, because we adhere to GitFlow.
  2. I have to check in on the build server... I don't think it's your fault... something broken with the Cake build script maybe.