fix: do not pass extra arg to logging.error

SATOSA formats all log messages explicitly before passing them to the logger.

Python logging formats messages if it receives extra args in the call,
otherwise pass them straight through.

This call to logger.error in _run_bound_endpoint was (accidentally)
passing an extra argument error.state, causing logging to do another
round of formatting on an already formatted message.

This is dangerous, as the text of the (already formatted) message may contain
externally supplied data - such as the redirect URI with URI-encoded data like %3A#2F
(which in best part just throw another exception - "Unknown formatting character A")

State is already included in the explicit message formatting, so the extra argument
here should be safe to remove.

Author: vladimir-mencl-eresearch

src/satosa/base.py

@@ -185,7 +185,7 @@ def _run_bound_endpoint(self, context, spec):
                 err_id=error.error_id, state=state
             )
             logline = lu.LOG_FMT.format(id=lu.get_session_id(context.state), message=msg)
-            logger.error(logline, error.state, exc_info=True)
+            logger.error(logline, exc_info=True)
             return self._handle_satosa_authentication_error(error)
 
     def _load_state(self, context):