Matching wrong provider when name is a substring of another provider

[tommymccallig]

Because the check in other_phase uses current_path.start_with?(request_path), it will match a provider whose name is a substring of another provider.

https://github.com/omniauth/omniauth-saml/blob/master/lib/omniauth/strategies/saml.rb#L72

request_path is defined in https://github.com/omniauth/omniauth/blob/master/lib/omniauth/strategy.rb#L386
as

@request_path ||= options[:request_path].is_a?(String) ?
    options[:request_path] :
    "#{path_prefix}/#{name}"

This can result in the wrong provider being set in env['omniauth.strategy'] and the wrong setup phase being run, etc.

Example:

provider1
provider10

If the path is /auth/provider10/metadata, then we'll match provider1, set env['omniauth.strategy'] to provider1 and run its setup phase.

[md5]

This seems like a valid report. How come you opened your PR against a fork?

[md5]

Ah, I see there's another PR

[tommymccallig]

@md5 Hi Mike, I've opened it against a fork and merged it so we can get this into production on our end as soon as possible. Obviously it would be ideal to have it available here so we don't diverge -
let me know if there are any changes required and I'd be happy to make them.