Moving setting to new lowercase_url_encoding security key

Author: alagos

lib/onelogin/ruby-saml/settings.rb

@@ -280,7 +280,8 @@ def get_binding(value)
           :digest_method              => XMLSecurity::Document::SHA1,
           :signature_method           => XMLSecurity::Document::RSA_SHA1,
           :check_idp_cert_expiration  => false,
-          :check_sp_cert_expiration   => false
+          :check_sp_cert_expiration   => false,
+          :lowercase_url_encoding     => false
         }.freeze
       }.freeze
     end

lib/onelogin/ruby-saml/slo_logoutrequest.rb

@@ -27,7 +27,6 @@ class SloLogoutrequest < SamlMessage
       # @param options [Hash]  :settings to provide the OneLogin::RubySaml::Settings object
       #                        Or :allowed_clock_drift for the logout request validation process to allow a clock drift when checking dates with
       #                        Or :relax_signature_validation to accept signatures if no idp certificate registered on settings
-      #                        Or :force_escape_downcasing to accept signatures if no idp certificate registered on settings
       #
       # @raise [ArgumentError] If Request is nil
       #
@@ -339,7 +338,7 @@ def validate_signature
 
       def escape_request_param(param)
         CGI.escape(param).tap do |escaped|
-          next unless options[:force_escape_downcasing]
+          next unless settings.security[:lowercase_url_encoding]
 
           escaped.gsub!(/%[A-Fa-f0-9]{2}/) { |match| match.downcase }
         end

test/slo_logoutrequest_test.rb

@@ -464,10 +464,10 @@ class RubySamlTest < Minitest::Test
         end
 
         # For this case, the parameters will be forced to be downcased after
-        # being escaped with :force_escape_downcasing option
+        # being escaped with :lowercase_url_encoding security option
+        settings.security[:lowercase_url_encoding] = true
         logout_request_force_downcasing_test = OneLogin::RubySaml::SloLogoutrequest.new(
-          params['SAMLRequest'], get_params: params, settings: settings,
-                                 force_escape_downcasing: true
+          params['SAMLRequest'], get_params: params, settings: settings
         )
         assert logout_request_force_downcasing_test.send(:validate_signature)
       end