Allowing a new option to force downcasing of CGI escaped characters

Author: alagos

lib/onelogin/ruby-saml/slo_logoutrequest.rb

@@ -27,6 +27,7 @@ class SloLogoutrequest < SamlMessage
       # @param options [Hash]  :settings to provide the OneLogin::RubySaml::Settings object
       #                        Or :allowed_clock_drift for the logout request validation process to allow a clock drift when checking dates with
       #                        Or :relax_signature_validation to accept signatures if no idp certificate registered on settings
+      #                        Or :force_escape_downcasing to accept signatures if no idp certificate registered on settings
       #
       # @raise [ArgumentError] If Request is nil
       #
@@ -263,13 +264,13 @@ def validate_signature
         # the exact same URI-encoding as the IDP. (This is not the case if the IDP is ADFS!)
         options[:raw_get_params] ||= {}
         if options[:raw_get_params]['SAMLRequest'].nil? && !options[:get_params]['SAMLRequest'].nil?
-          options[:raw_get_params]['SAMLRequest'] = CGI.escape(options[:get_params]['SAMLRequest'])
+          options[:raw_get_params]['SAMLRequest'] = escape_request_param(options[:get_params]['SAMLRequest'])
         end
         if options[:raw_get_params]['RelayState'].nil? && !options[:get_params]['RelayState'].nil?
-          options[:raw_get_params]['RelayState'] = CGI.escape(options[:get_params]['RelayState'])
+          options[:raw_get_params]['RelayState'] = escape_request_param(options[:get_params]['RelayState'])
         end
         if options[:raw_get_params]['SigAlg'].nil? && !options[:get_params]['SigAlg'].nil?
-          options[:raw_get_params]['SigAlg'] = CGI.escape(options[:get_params]['SigAlg'])
+          options[:raw_get_params]['SigAlg'] = escape_request_param(options[:get_params]['SigAlg'])
         end
 
         # If we only received the raw version of SigAlg,
@@ -336,6 +337,13 @@ def validate_signature
         true
       end
 
+      def escape_request_param(param)
+        CGI.escape(param).tap do |escaped|
+          next unless options[:force_escape_downcasing]
+
+          escaped.gsub!(/%[A-Fa-f0-9]{2}/) { |match| match.downcase }
+        end
+      end
     end
   end
 end