[JIRA] Created: (SIDP-514) Alt text for IdP Logos is not esapiEncoder.encodeForHTMLAttribute

Tue Aug 30 16:45:25 BST 2011

Alt text for IdP Logos is not esapiEncoder.encodeForHTMLAttribute
-----------------------------------------------------------------

                 Key: SIDP-514
                 URL: https://issues.shibboleth.net/jira/browse/SIDP-514
             Project: Shibboleth IdP 2 - Java
          Issue Type: Bug
      Security Level: Standard (Standard bug, may impact functionality but does not represent a security vulnerability )
          Components: Authentication
    Affects Versions: 2.3.3
            Reporter: Rod Widdowson
            Assignee: Chad La Joie

I spotted this by inspection. 

Summary has all thr information.  I have a fix made, but it is queued up behind the fix for SIDP-523 (which needs tested)

This bug probably required SIDP-504 to be present before it fire.

Security risk is mitigated by the fact that the the data we are spuitting out is in some way "trusted" (if you don't trust your metadata, what do you trust"

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira