Internal server error for uid with slash (/)

Nextcloud does not handle correcly user ids with slashes and throws HTTP Error 500. If a user has a slash in the uid while logging on, nextcloud throws Internal Server Error and no actions on the user are effective through the administration panel for users. The user can only be deleted or managed through the cli.

In our scenario we use the user_saml plugin and the uid with the slashes is automatically generated for random users due to the computedid function we use on the IdP (the SHA1 result of the username with a salt)

Steps to reproduce

Use the user_saml app and map the uid attribute to a computedid attribute released from your idp
Choose a user that the computedid includes a / value
Login to your nextcloud installation
The user is redirected to the idp, authenticates successfully and when returns to the nextcloud gets an internal server error
Check the nextcloud log file
{"reqId":"ctzyfLMCeapVPqvb4e9i","level":3,"time":"2018-02-20T09:33:04+00:00","remoteAddr":"10.113.13.11","user":"wXHHqYbG/zM16zmnKGOk1A5gNng=","app":"index","method":"GET","url":"/index.php/apps/files/","message":"Exception: {"Exception":"Symfony\Component\Routing\Exception\InvalidParameterException","Message":"Parameter "userId" for route "core.avatar.getAvatar" must match "[^/]++" ("wXHHqYbG/zM16zmnKGOk1A5gNng=" given) to generate a corresponding URL.","Code":0,"Trace":"#0 /docroot/owncloud.domain.tld/3rdparty/symfony/routing/Generator/UrlGenerator.php(136): Symfony\Component\Routing\Generator\UrlGenerator->doGenerate(Array, Array, Array, Array, Array, 'core.avatar.get...', 1, Array, Array)\n#1 /docroot/owncloud.domain.tld/lib/private/Route/Router.php(337): Symfony\Component\Routing\Generator\UrlGenerator->generate('core.avatar.get...', Array, 1)\n#2 /docroot/owncloud.domain.tld/lib/private/Route/CachingRouter.php(60): OC\Route\Router->generate('core.avatar.get...', Array, false)\n#3 /docroot/owncloud.domain.tld/lib/private/URLGenerator.php(79): OC\Route\CachingRouter->generate('core.avatar.get...', Array)\n#4 /docroot/owncloud.domain.tld/core/templates/layout.user.php(114): OC\URLGenerator->linkToRoute('core.avatar.get...', Array)\n#5 /docroot/owncloud.domain.tld/lib/private/Template/Base.php(176): include('/docroot/owncloud.s...')\n#6 /docroot/owncloud.domain.tld/lib/private/Template/Base.php(151): OC\Template\Base->load('/docroot/owncloud.s...', NULL)\n#7 /docroot/owncloud.domain.tld/lib/private/legacy/template.php(204): OC\Template\Base->fetchPage(NULL)\n#8 /docroot/owncloud.domain.tld/lib/private/legacy/template.php(229): OC_Template->fetchPage()\n#9 /docroot/owncloud.domain.tld/lib/public/AppFramework/Http/TemplateResponse.php(157): OC_Template->fetchPage()\n#10 /docroot/owncloud.domain.tld/lib/private/AppFramework/Http/Dispatcher.php(114): OCP\AppFramework\Http\TemplateResponse->render()\n#11 /docroot/owncloud.domain.tld/lib/private/AppFramework/App.php(115): OC\AppFramework\Http\Dispatcher->dispatch(Object(OCA\Files\Controller\ViewController), 'index')\n#12 /docroot/owncloud.domain.tld/lib/private/AppFramework/Routing/RouteActionHandler.php(47): OC\AppFramework\App::main('ViewController', 'index', Object(OC\AppFramework\DependencyInjection\DIContainer), Array)\n#13 [internal function]: OC\AppFramework\Routing\RouteActionHandler->__invoke(Array)\n#14 /docroot/owncloud.domain.tld/lib/private/Route/Router.php(297): call_user_func(Object(OC\AppFramework\Routing\RouteActionHandler), Array)\n#15 /docroot/owncloud.domain.tld/lib/base.php(998): OC\Route\Router->match('/apps/files/')\n#16 /docroot/owncloud.domain.tld/index.php(37): OC::handleRequest()\n#17 {main}","File":"/docroot/owncloud.domain.tld/3rdparty/symfony/routing/Generator/UrlGenerator.php","Line":163}","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","version":"13.0.0.14"}
Expected behaviour

Login to nextcloud

Actual behaviour

Internal Server error

Server configuration

Operating system:
CentOS 7

Web server:
Apache 2.4

Database:
MySQL
PHP version:
Php 5.4
Nextcloud version: (see Nextcloud admin page)
13
Updated from an older Nextcloud/ownCloud or fresh install:
updated from owncloud 10

List of activated apps:

App list
Nextcloud configuration:

Config report
Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
SAML

Start with the reported failure in core/templates/layout.user.php and the core.avatar.getAvatar route, following the stack trace into Symfony's UrlGenerator.php. Reproduce with a SAML-generated uid containing a slash and inspect the Nextcloud log. Done means the user can log in without an HTTP 500 and can be managed through the administration panel.