diff options
| author | Thomas Lenz <tlenz@iaik.tugraz.at> | 2017-11-13 09:38:00 +0100 |
|---|---|---|
| committer | Thomas Lenz <tlenz@iaik.tugraz.at> | 2017-11-13 09:38:00 +0100 |
| commit | fe2a02ec2afcbe2d7b9d59a9969d05923813ffdf (patch) | |
| tree | 80ad79cfce7fc1cf70af16279de74b1e0b620e68 /id/server/moa-id-frontend-resources/src/main/java/at/gv | |
| parent | 6c9f624713895a08fd8c89ed3b86acfe149e6229 (diff) | |
| download | moa-id-spss-fe2a02ec2afcbe2d7b9d59a9969d05923813ffdf.tar.gz moa-id-spss-fe2a02ec2afcbe2d7b9d59a9969d05923813ffdf.tar.bz2 moa-id-spss-fe2a02ec2afcbe2d7b9d59a9969d05923813ffdf.zip | |
fix some open CrossSiteScripting paths
Diffstat (limited to 'id/server/moa-id-frontend-resources/src/main/java/at/gv')
2 files changed, 13 insertions, 2 deletions
diff --git a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java index da38e3bef..15bc92a54 100644 --- a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java +++ b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java @@ -27,6 +27,8 @@ import java.io.InputStream; import java.util.HashMap; import java.util.Map; +import org.apache.commons.lang.StringEscapeUtils; + import at.gv.egovernment.moa.id.auth.frontend.utils.FormBuildUtils; import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants; import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters; @@ -100,7 +102,7 @@ public abstract class AbstractServiceProviderSpecificGUIFormBuilderConfiguration params.put(PARAM_BKU_LOCAL, IOAAuthParameters.LOCALBKU); if (pendingReq != null) { - params.put(PARAM_PENDINGREQUESTID, pendingReq.getRequestID()); + params.put(PARAM_PENDINGREQUESTID, StringEscapeUtils.escapeHtml(pendingReq.getRequestID())); //add service-provider specific GUI parameters IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration(); diff --git a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java index 2c2792b84..0c07ad3fb 100644 --- a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java +++ b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java @@ -26,6 +26,8 @@ import java.io.InputStream; import java.util.HashMap; import java.util.Map; +import org.apache.commons.lang.StringEscapeUtils; + import at.gv.egovernment.moa.id.commons.api.IRequest; /** @@ -68,6 +70,13 @@ public class DefaultGUIFormBuilderConfiguration extends AbstractGUIFormBuilderCo } + /** + * Add a key/value pair into Velocity context.<br> + * <b>IMPORTANT:</b> external HTML escapetion is required, because it is NOT done internally + * + * @param key velocity context key + * @param value of this key + */ public void putCustomParameter(String key, Object value) { if (customParameters == null) customParameters = new HashMap<String, Object>(); @@ -82,7 +91,7 @@ public class DefaultGUIFormBuilderConfiguration extends AbstractGUIFormBuilderCo public Map<String, Object> getSpecificViewParameters() { Map<String, Object> params = new HashMap<String, Object>(); if (pendingReq != null) { - params.put(PARAM_PENDINGREQUESTID, pendingReq.getRequestID()); + params.put(PARAM_PENDINGREQUESTID, StringEscapeUtils.escapeHtml(pendingReq.getRequestID())); } if (customParameters != null) |