SEC-2159: OpenIDAuthenticationFilter.buildReturnToUrl() should call response.encodeUrl()

[spring-projects-issues]

Janning Vygen (Migrated from SEC-2159) said:

protected String buildReturnToUrl(HttpServletRequest request)
{
...
return sb.toString();
}

should be

protected String buildReturnToUrl(HttpServletRequest request, HttpServletResponse response)
{
private encodeReturnToUrl = false;
...
if (encodeReturnToUrl) {
return response.encodeRedirectUrl(sb.toString());
}
return sb.toString();
}

This way the usual rules about outbound urls apply. In our case we have an OutboundRewriteRule which rewrites all urls.

For backwards compatibility a property "encodeReturnToUrl" should be added which is false by default