aboutsummaryrefslogtreecommitdiff
path: root/id/server/moa-id-frontend-resources/src/main/java
diff options
context:
space:
mode:
authorThomas Lenz <tlenz@iaik.tugraz.at>2017-11-13 09:38:00 +0100
committerThomas Lenz <tlenz@iaik.tugraz.at>2017-11-13 09:38:00 +0100
commitfe2a02ec2afcbe2d7b9d59a9969d05923813ffdf (patch)
tree80ad79cfce7fc1cf70af16279de74b1e0b620e68 /id/server/moa-id-frontend-resources/src/main/java
parent6c9f624713895a08fd8c89ed3b86acfe149e6229 (diff)
downloadmoa-id-spss-fe2a02ec2afcbe2d7b9d59a9969d05923813ffdf.tar.gz
moa-id-spss-fe2a02ec2afcbe2d7b9d59a9969d05923813ffdf.tar.bz2
moa-id-spss-fe2a02ec2afcbe2d7b9d59a9969d05923813ffdf.zip
fix some open CrossSiteScripting paths
Diffstat (limited to 'id/server/moa-id-frontend-resources/src/main/java')
-rw-r--r--id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java4
-rw-r--r--id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java11
2 files changed, 13 insertions, 2 deletions
diff --git a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java
index da38e3bef..15bc92a54 100644
--- a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java
+++ b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java
@@ -27,6 +27,8 @@ import java.io.InputStream;
import java.util.HashMap;
import java.util.Map;
+import org.apache.commons.lang.StringEscapeUtils;
+
import at.gv.egovernment.moa.id.auth.frontend.utils.FormBuildUtils;
import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
@@ -100,7 +102,7 @@ public abstract class AbstractServiceProviderSpecificGUIFormBuilderConfiguration
params.put(PARAM_BKU_LOCAL, IOAAuthParameters.LOCALBKU);
if (pendingReq != null) {
- params.put(PARAM_PENDINGREQUESTID, pendingReq.getRequestID());
+ params.put(PARAM_PENDINGREQUESTID, StringEscapeUtils.escapeHtml(pendingReq.getRequestID()));
//add service-provider specific GUI parameters
IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
diff --git a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java
index 2c2792b84..0c07ad3fb 100644
--- a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java
+++ b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java
@@ -26,6 +26,8 @@ import java.io.InputStream;
import java.util.HashMap;
import java.util.Map;
+import org.apache.commons.lang.StringEscapeUtils;
+
import at.gv.egovernment.moa.id.commons.api.IRequest;
/**
@@ -68,6 +70,13 @@ public class DefaultGUIFormBuilderConfiguration extends AbstractGUIFormBuilderCo
}
+ /**
+ * Add a key/value pair into Velocity context.<br>
+ * <b>IMPORTANT:</b> external HTML escapetion is required, because it is NOT done internally
+ *
+ * @param key velocity context key
+ * @param value of this key
+ */
public void putCustomParameter(String key, Object value) {
if (customParameters == null)
customParameters = new HashMap<String, Object>();
@@ -82,7 +91,7 @@ public class DefaultGUIFormBuilderConfiguration extends AbstractGUIFormBuilderCo
public Map<String, Object> getSpecificViewParameters() {
Map<String, Object> params = new HashMap<String, Object>();
if (pendingReq != null) {
- params.put(PARAM_PENDINGREQUESTID, pendingReq.getRequestID());
+ params.put(PARAM_PENDINGREQUESTID, StringEscapeUtils.escapeHtml(pendingReq.getRequestID()));
}
if (customParameters != null)