SEC-2159: OpenIDAuthenticationFilter.buildReturnToUrl() should call response.encodeUrl()

Janning Vygen (Migrated from SEC-2159) said:

protected String buildReturnToUrl(HttpServletRequest request)
{
...
return sb.toString();
}

should be

protected String buildReturnToUrl(HttpServletRequest request, HttpServletResponse response)
{
private encodeReturnToUrl = false;
...
if (encodeReturnToUrl) {
return response.encodeRedirectUrl(sb.toString());
}
return sb.toString();
}

This way the usual rules about outbound urls apply. In our case we have an OutboundRewriteRule which rewrites all urls.

For backwards compatibility a property "encodeReturnToUrl" should be added which is false by default

Start at OpenIDAuthenticationFilter.buildReturnToUrl(HttpServletRequest) and read how the return URL is constructed and used. Compare the requested response URL-encoding behavior and the proposed encodeReturnToUrl compatibility property, then verify the default remains unchanged while the opt-in behavior applies consistently.