1 files changed, 12 insertions, 0 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SelectBKUServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SelectBKUServlet.java
index 78c028767..09b3ae15f 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SelectBKUServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SelectBKUServlet.java
@@ -29,6 +29,7 @@ import at.gv.egovernment.moa.id.auth.MOAIDAuthInitializer;
 import at.gv.egovernment.moa.id.auth.WrongParametersException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
 import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
 import at.gv.egovernment.moa.logging.Logger;
 
 /**
@@ -74,6 +75,7 @@ public class SelectBKUServlet extends AuthServlet {
       authURL = authURL.concat(":" + req.getServerPort());
     }
     authURL = authURL.concat(req.getContextPath() + "/");
+
     String target = req.getParameter(PARAM_TARGET);
     String oaURL = req.getParameter(PARAM_OA);
     String bkuSelectionTemplateURL = req.getParameter(PARAM_BKUTEMPLATE);
@@ -84,6 +86,16 @@ public class SelectBKUServlet extends AuthServlet {
     resp.addHeader(HEADER_CACHE_CONTROL,HEADER_VALUE_CACHE_CONTROL_IE);
 
     try {
+       
+       // check parameter
+       if (!ParamValidatorUtils.isValidTarget(target))
+          throw new WrongParametersException("StartAuthentication", PARAM_TARGET, "auth.12");
+       if (!ParamValidatorUtils.isValidOA(oaURL))
+          throw new WrongParametersException("StartAuthentication", PARAM_OA, "auth.12");
+       if (!ParamValidatorUtils.isValidTemplate(templateURL))
+          throw new WrongParametersException("StartAuthentication", PARAM_TEMPLATE, "auth.12");
+
+       
       String returnValue = AuthenticationServer.getInstance().selectBKU(
         authURL, target, oaURL, bkuSelectionTemplateURL, templateURL);
       String bkuSelectionType = AuthConfigurationProvider.getInstance().getBKUSelectionType();