summaryrefslogtreecommitdiff
path: root/bkucommon/src/main/java/at/gv
diff options
context:
space:
mode:
Diffstat (limited to 'bkucommon/src/main/java/at/gv')
-rw-r--r--bkucommon/src/main/java/at/gv/egiz/bku/binding/HTTPBindingProcessorImpl.java9
1 files changed, 7 insertions, 2 deletions
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/binding/HTTPBindingProcessorImpl.java b/bkucommon/src/main/java/at/gv/egiz/bku/binding/HTTPBindingProcessorImpl.java
index 615fcc9d..18e38752 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/binding/HTTPBindingProcessorImpl.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/binding/HTTPBindingProcessorImpl.java
@@ -437,7 +437,7 @@ public class HTTPBindingProcessorImpl extends AbstractBindingProcessor implement
} else {
log.info("Content type not set in dataurl response.");
closeDataUrlConnection();
- throw new SLBindingException(2007);
+ throw new SLBindingException(2007);
}
break;
@@ -608,7 +608,12 @@ public class HTTPBindingProcessorImpl extends AbstractBindingProcessor implement
* @return null if redirect url is not set.
*/
public String getRedirectURL() {
- return getFormParameterAsString(FixedFormParameters.REDIRECTURL);
+ String redirectURL = getFormParameterAsString(FixedFormParameters.REDIRECTURL);
+ log.debug("Evaluating redirectURL: " + redirectURL);
+ if (redirectURL == null || redirectURL.isEmpty() || redirectURL.contains("\r") || redirectURL.contains("\n") ||
+ redirectURL.contains("<") || redirectURL.toLowerCase().contains("javascript:"))
+ return null;
+ return redirectURL;
}
public String getFormDataContentType(String aParameterName) {