Encode postLogoutRedirectUri query params

Now encodes already encoded queryparameters in postLogoutRedirectUrl
correctly

Closes gh-9511

Author: hosea

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/web/logout/OidcClientInitiatedLogoutSuccessHandler.java

@@ -100,9 +100,9 @@ private URI postLogoutRedirectUri(HttpServletRequest request) {
 				.replaceQuery(null)
 				.fragment(null)
 				.build();
-		return UriComponentsBuilder.fromUriString(this.postLogoutRedirectUri)
+		return URI.create (UriComponentsBuilder.fromUriString(this.postLogoutRedirectUri)
 				.buildAndExpand(Collections.singletonMap("baseUrl", uriComponents.toUriString()))
-				.toUri();
+				.toUriString());
 	}
 
 

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/oidc/web/logout/OidcClientInitiatedLogoutSuccessHandlerTests.java

@@ -165,6 +165,17 @@ public void logoutWhenUsingPostLogoutRedirectUriTemplateThenBuildsItForRedirect(
 				"post_logout_redirect_uri=https://rp.example.org");
 	}
 
+	@Test
+	public void logoutWhenUsingPostLogoutRedirectUriWithQueryParametersThenBuildItForRedirectWithEncodedQueryParameters() throws IOException, ServletException {
+		OAuth2AuthenticationToken token = new OAuth2AuthenticationToken(TestOidcUsers.create(),
+				AuthorityUtils.NO_AUTHORITIES, this.registration.getRegistrationId());
+		this.handler.setPostLogoutRedirectUri("https://rp.example.org/context?forwardUrl=secured%3Fparam%3Dtrue");
+		this.request.setUserPrincipal(token);
+		this.handler.onLogoutSuccess(this.request, this.response, token);
+		assertThat(this.response.getRedirectedUrl()).isEqualTo(
+				"https://endpoint?" + "id_token_hint=id-token&" + "post_logout_redirect_uri=https://rp.example.org/context?forwardUrl%3Dsecured%253Fparam%253Dtrue");
+	}
+
 	@Test
 	public void setPostLogoutRedirectUriWhenGivenNullThenThrowsException() {
 		assertThatThrownBy(() -> this.handler.setPostLogoutRedirectUri((URI) null))