diff options
| author | Thomas Lenz <tlenz@iaik.tugraz.at> | 2017-11-27 12:18:38 +0100 |
|---|---|---|
| committer | Thomas Lenz <tlenz@iaik.tugraz.at> | 2017-11-27 12:18:38 +0100 |
| commit | ee06b644dbedbe4869de6b926339581a5eefb430 (patch) | |
| tree | 56bd1e55097d122c0ff0e9befcbe892605c05bc1 /id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth | |
| parent | 5f2ad9d48b83d5979b1a147190f5177e3327744a (diff) | |
| parent | cc09b52b5cb1c93543d8b4353dfc59b8192e79af (diff) | |
| download | moa-id-spss-ee06b644dbedbe4869de6b926339581a5eefb430.tar.gz moa-id-spss-ee06b644dbedbe4869de6b926339581a5eefb430.tar.bz2 moa-id-spss-ee06b644dbedbe4869de6b926339581a5eefb430.zip | |
Merge branch 'eIDAS_node_implementation' of gitlab.iaik.tugraz.at:egiz/moa-idspss into eIDAS_node_implementation
Diffstat (limited to 'id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth')
3 files changed, 6 insertions, 4 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java index e396433e4..dcf337213 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java @@ -254,7 +254,8 @@ public abstract class AbstractController extends MOAIDAuthConstants { //add stacktrace if debug is enabled if (Logger.isTraceEnabled()) { - config.putCustomParameter("stacktrace", getStacktraceFromException(error)); + config.putCustomParameter("stacktrace", + StringEscapeUtils.escapeHtml(getStacktraceFromException(error))); } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/IDPSingleLogOutServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/IDPSingleLogOutServlet.java index a146f778e..19f3fdc54 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/IDPSingleLogOutServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/IDPSingleLogOutServlet.java @@ -28,6 +28,7 @@ import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import org.apache.commons.lang.StringEscapeUtils; import org.opensaml.saml2.core.LogoutResponse; import org.opensaml.saml2.metadata.SingleLogoutService; import org.springframework.beans.factory.annotation.Autowired; @@ -93,9 +94,9 @@ public class IDPSingleLogOutServlet extends AbstractController { String ssoid = ssoManager.getSSOSessionID(req); - Object restartProcessObj = req.getParameter(MOAIDAuthConstants.PARAM_SLORESTART); + Object restartProcessObj = StringEscapeUtils.escapeHtml(req.getParameter(MOAIDAuthConstants.PARAM_SLORESTART)); - Object tokkenObj = req.getParameter(MOAIDAuthConstants.PARAM_SLOSTATUS); + Object tokkenObj = StringEscapeUtils.escapeHtml(req.getParameter(MOAIDAuthConstants.PARAM_SLOSTATUS)); String tokken = null; String status = null; if (tokkenObj != null && tokkenObj instanceof String) { diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java index be511d888..a7f911845 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java @@ -65,7 +65,7 @@ public class RedirectServlet { Logger.debug("Receive " + RedirectServlet.class + " Request"); String url = req.getParameter(REDIRCT_PARAM_URL); - String target = req.getParameter(MOAIDAuthConstants.PARAM_TARGET); + String target = StringEscapeUtils.escapeHtml(req.getParameter(MOAIDAuthConstants.PARAM_TARGET)); String artifact = req.getParameter(MOAIDAuthConstants.PARAM_SAMLARTIFACT); String interIDP = req.getParameter(MOAIDAuthConstants.INTERFEDERATION_IDP); |