pyFF icon indicating copy to clipboard operation
pyFF copied to clipboard

Fix MDQ Endpoint Behavior for EntityIDs with .xml or Trailing Slash

Open CzNorbi opened this issue 5 months ago • 5 comments
trafficstars

Problem

In PyFF 2.x, the MDQ handler attempts to parse the URL path and remove the extensions (like .xml or .json) under the assumption that these are used to indicate the desired response format.

However, in some cases, clients request metadata using fully encoded entityIDs like:

/entities/https%3A%2F%2Fidp.example.org.xml

In this case, the .xml is part of the actual entityID. PyFF would remove this suffix and attempt to resolve https://idp.example.org, which does not exist in the metadata. The result is an empty EntitiesDescriptor in XML responses or an empty list in JSON.

Solution

This patch modifies the _d() function to:

Only strip .xml or .json suffixes if the remaining path does not appear to be a percent-encoded entityID or a hash-based entityID ({sha1}, {sha256}, {md5}). If the entityID appears to be encoded or hashed and ends in .xml or .json, it is treated as part of the true entityID and preserved during lookup.

Additional fix: Preserves a trailing / if present in the request path.

CzNorbi avatar Jun 20 '25 12:06 CzNorbi