diff --git a/openid/src/main/java/org/springframework/security/openid/OpenIDAuthenticationFilter.java b/openid/src/main/java/org/springframework/security/openid/OpenIDAuthenticationFilter.java index 503ef6e434..188fcd5eac 100644 --- a/openid/src/main/java/org/springframework/security/openid/OpenIDAuthenticationFilter.java +++ b/openid/src/main/java/org/springframework/security/openid/OpenIDAuthenticationFilter.java @@ -188,37 +188,31 @@ public class OpenIDAuthenticationFilter extends AbstractAuthenticationProcessing * @return The return_to URL. */ protected String buildReturnToUrl(HttpServletRequest request) { - try { - StringBuffer sb = request.getRequestURL(); - - Iterator iterator = returnToUrlParameters.iterator(); - boolean isFirst = true; - - while (iterator.hasNext()) { - String name = iterator.next(); - // Assume for simplicity that there is only one value - String value = request.getParameter(name); - - if (value == null) { - continue; - } - - if (isFirst) { - sb.append("?"); - isFirst = false; - } - sb.append(URLEncoder.encode(name, "UTF-8")).append("=").append(URLEncoder.encode(value, "UTF-8")); - - if (iterator.hasNext()) { - sb.append("&"); - } + StringBuffer sb = request.getRequestURL(); + + Iterator iterator = returnToUrlParameters.iterator(); + boolean isFirst = true; + + while (iterator.hasNext()) { + String name = iterator.next(); + // Assume for simplicity that there is only one value + String value = request.getParameter(name); + + if (value == null) { + continue; + } + + if (isFirst) { + sb.append("?"); + isFirst = false; + } + sb.append(utf8UrlEncode(name)).append("=").append(utf8UrlEncode(value)); + + if (iterator.hasNext()) { + sb.append("&"); } - return sb.toString(); - } catch(UnsupportedEncodingException e) { - Error err = new AssertionError("The Java platform guarantees UTF-8 support, but it seemingly is not present."); - err.initCause(e); - throw err; } + return sb.toString(); } /** @@ -276,4 +270,20 @@ public class OpenIDAuthenticationFilter extends AbstractAuthenticationProcessing Assert.notNull(returnToUrlParameters, "returnToUrlParameters cannot be null"); this.returnToUrlParameters = returnToUrlParameters; } + + /** + * Performs URL encoding with UTF-8 + * + * @param value the value to URL encode + * @return the encoded value + */ + private String utf8UrlEncode(String value) { + try { + return URLEncoder.encode(value, "UTF-8"); + } catch(UnsupportedEncodingException e) { + Error err = new AssertionError("The Java platform guarantees UTF-8 support, but it seemingly is not present."); + err.initCause(e); + throw err; + } + } }