Merge branch 'eSense_eIDAS_development' of gitlab.iaik.tugraz.at:afitzek/moa-idspss into eSense_eIDAS_development

1 files changed, 3 insertions, 2 deletions

diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java
index b69d37d57..b73859d81 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java
@@ -90,12 +90,13 @@ public class StorkConfigValidator {
 		// check attributes
 		if (MiscUtil.isNotEmpty(form.getAttributes())) {
 			for(StorkAttribute check : form.getAttributes()) {
-				if (ValidationHelper.containsPotentialCSSCharacter(check.getName(), true)) {
+				String tmp = check.getName().replace("eidas/attributes/", ""); // since eIDaS attributes come with a "/", we need to exclude them from validation. TODO Or should we require the admin to escape them in the UI?
+				if (ValidationHelper.containsPotentialCSSCharacter(tmp, true)) { 
 					log.warn("default attributes contains potentail XSS characters: " + check);
 					errors.add(LanguageHelper.getErrorString("validation.stork.requestedattributes",
 							new Object[] {ValidationHelper.getPotentialCSSCharacter(true)}, request ));
 				}
-				if(!check.getName().toLowerCase().matches("^[a-z0-9]*$")) {
+				if(!tmp.toLowerCase().matches("^[A-Za-z]*$")) {
 						log.warn("default attributes do not match the requested format : " + check);
 						errors.add(LanguageHelper.getErrorString("validation.stork.requestedattributes",
 								new Object[] {check}, request ));