From 1c72b7989e9e97d13048d34fc292fa9578f35022 Mon Sep 17 00:00:00 2001
From: Luke Taylor <luke.taylor@springsource.com>
Date: Mon, 27 Aug 2007 17:14:23 +0000
Subject: [PATCH] Fix for SEC-522. Strip query parameters from logout URL
 before doing comparison with filterProcessesUrl.

---
 .../acegisecurity/ui/logout/LogoutFilter.java |  9 ++++-
 .../ui/logout/LogoutHandlerTests.java         | 38 +++++++++++++++++++
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 core/src/test/java/org/acegisecurity/ui/logout/LogoutHandlerTests.java

diff --git a/core/src/main/java/org/acegisecurity/ui/logout/LogoutFilter.java b/core/src/main/java/org/acegisecurity/ui/logout/LogoutFilter.java
index 6ad9c8be2d..eb541cc0b8 100644
--- a/core/src/main/java/org/acegisecurity/ui/logout/LogoutFilter.java
+++ b/core/src/main/java/org/acegisecurity/ui/logout/LogoutFilter.java
@@ -133,10 +133,17 @@ public class LogoutFilter implements Filter {
         int pathParamIndex = uri.indexOf(';');
 
         if (pathParamIndex > 0) {
-            // strip everything after the first semi-colon
+            // strip everything from the first semi-colon
             uri = uri.substring(0, pathParamIndex);
         }
 
+        int queryParamIndex = uri.indexOf('?');
+
+        if (queryParamIndex > 0) {
+            // strip everything from the first question mark
+            uri = uri.substring(0, queryParamIndex);
+        }
+
         if ("".equals(request.getContextPath())) {
             return uri.endsWith(filterProcessesUrl);
         }
diff --git a/core/src/test/java/org/acegisecurity/ui/logout/LogoutHandlerTests.java b/core/src/test/java/org/acegisecurity/ui/logout/LogoutHandlerTests.java
new file mode 100644
index 0000000000..a984e6e079
--- /dev/null
+++ b/core/src/test/java/org/acegisecurity/ui/logout/LogoutHandlerTests.java
@@ -0,0 +1,38 @@
+package org.acegisecurity.ui.logout;
+
+import junit.framework.TestCase;
+
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+/**
+ * @author Luke Taylor
+ * @version $Id$
+ */
+public class LogoutHandlerTests extends TestCase {
+    LogoutFilter filter;
+
+    protected void setUp() throws Exception {
+        filter = new LogoutFilter("/success", new LogoutHandler[] {new SecurityContextLogoutHandler()});
+    }
+
+    public void testRequiresLogoutUrlWorksWithPathParams() {
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        request.setRequestURI("/j_acegi_logout;someparam=blah?otherparam=blah");
+
+        assertTrue(filter.requiresLogout(request, response));
+    }
+
+    public void testRequiresLogoutUrlWorksWithQueryParams() {
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setContextPath("/context");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        request.setRequestURI("/context/j_acegi_logout?param=blah");
+
+        assertTrue(filter.requiresLogout(request, response));
+    }
+
+}