add escaping on some places

4 files changed, 47 insertions, 5 deletions

diff --git a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractGUIFormBuilderConfiguration.java b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractGUIFormBuilderConfiguration.java
index 52c1f0f97..d57834192 100644
--- a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractGUIFormBuilderConfiguration.java
+++ b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractGUIFormBuilderConfiguration.java
@@ -70,7 +70,8 @@ public abstract class AbstractGUIFormBuilderConfiguration implements IGUIBuilder
 	
 	
 	/**
-	 * Define the parameters, which should be evaluated in the template
+	 * Define the parameters, which should be evaluated in the template <br>
+	 * <b>IMPORTANT:</b> external HTML escapetion is required, because it is NOT done internally during the building process
 	 * 
 	 * @return Map of parameters, which should be added to template
 	 */
diff --git a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java
index 15bc92a54..ad068ac49 100644
--- a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java
+++ b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java
@@ -65,6 +65,7 @@ public abstract class AbstractServiceProviderSpecificGUIFormBuilderConfiguration
 	
 	protected IRequest pendingReq = null;
 	protected String templateClasspahtDir = null;
+	private  Map<String, Object> customParameters = null;
 	
 	/**
 	 * @param authURL PublicURLPrefix of the IDP but never null
@@ -91,11 +92,29 @@ public abstract class AbstractServiceProviderSpecificGUIFormBuilderConfiguration
 		
 	}
 
+	/**
+	 * Add a key/value pair into Velocity context.<br>
+	 * Parameter values get escaped internally
+	 * 
+	 * @param key velocity context key
+	 * @param value of this key
+	 */
+	public void putCustomParameter(String key, Object value) {
+		if (customParameters == null)
+			customParameters = new HashMap<String, Object>();
+		
+		if (value instanceof String)
+			customParameters.put(key, StringEscapeUtils.escapeHtml((String)value));
+		else
+			customParameters.put(key, StringEscapeUtils.escapeHtml(value.toString()));
+		
+	}
+	
 	/* (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.auth.frontend.builder.IGUIBuilderConfiguration#getViewParameters()
 	 */
 	@Override
-	public Map<String, Object> getSpecificViewParameters() {
+	public final Map<String, Object> getSpecificViewParameters() {
 		Map<String, Object> params =  new HashMap<String, Object>();
 		params.put(PARAM_BKU_ONLINE, IOAAuthParameters.THIRDBKU);
 		params.put(PARAM_BKU_HANDY, IOAAuthParameters.HANDYBKU);
@@ -107,7 +126,7 @@ public abstract class AbstractServiceProviderSpecificGUIFormBuilderConfiguration
 			//add service-provider specific GUI parameters
 			IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
 			if (oaParam != null) {
-				params.put(PARAM_OANAME, oaParam.getFriendlyName());
+				params.put(PARAM_OANAME, StringEscapeUtils.escapeHtml(oaParam.getFriendlyName()));
 
 				//set BKU URLs
 				if (MiscUtil.isNotEmpty(oaParam.getBKUURL(IOAAuthParameters.LOCALBKU)))
@@ -138,6 +157,10 @@ public abstract class AbstractServiceProviderSpecificGUIFormBuilderConfiguration
 			
 		}
 
+		//add additional custom parameters
+		if (customParameters != null)
+			params.putAll(customParameters);
+		
 		return params;
 	}
 	
diff --git a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java
index 0c07ad3fb..901dbae53 100644
--- a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java
+++ b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java
@@ -77,13 +77,31 @@ public class DefaultGUIFormBuilderConfiguration extends AbstractGUIFormBuilderCo
 	 * @param key velocity context key
 	 * @param value of this key
 	 */
-	public void putCustomParameter(String key, Object value) {
+	public void putCustomParameterWithOutEscaption(String key, Object value) {
 		if (customParameters == null)
 			customParameters = new HashMap<String, Object>();
 		
 		customParameters.put(key, value);
 	}
 	
+	/**
+	 * Add a key/value pair into Velocity context.<br>
+	 * All parameters get escaped internally
+	 * 
+	 * @param key velocity context key
+	 * @param value of this key
+	 */
+	public void putCustomParameter(String key, Object value) {
+		if (customParameters == null)
+			customParameters = new HashMap<String, Object>();
+		
+		if (value instanceof String)
+			customParameters.put(key, StringEscapeUtils.escapeHtml((String)value));
+		else
+			customParameters.put(key, StringEscapeUtils.escapeHtml(value.toString()));
+		
+	}
+	
 	/* (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.auth.frontend.builder.IGUIBuilderConfiguration#getViewParameters()
 	 */
diff --git a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/SPSpecificGUIBuilderConfigurationWithDBLoad.java b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/SPSpecificGUIBuilderConfigurationWithDBLoad.java
index 13d8d3bb7..0215afc41 100644
--- a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/SPSpecificGUIBuilderConfigurationWithDBLoad.java
+++ b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/SPSpecificGUIBuilderConfigurationWithDBLoad.java
@@ -56,7 +56,7 @@ public class SPSpecificGUIBuilderConfigurationWithDBLoad extends AbstractService
 		super(pendingReq, viewName, formSubmitEndpoint);
 		
 	}
-
+	
 	/* (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.auth.frontend.AbstractGUIFormBuilder#getTemplate(java.lang.String)
 	 */