[JIRA] Resolved: (SIDP-514) Alt text for IdP Logos is not esapiEncoder.encodeForHTMLAttribute

[Rod Widdowson (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SIDP-514?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Rod Widdowson resolved SIDP-514.
--------------------------------

    Resolution: Fixed

Also spotted that the text element in hyperlinks (provided in the jsp page and so even less of a threat) was not being encoded.

Fixed in 3065

> Alt text for IdP Logos is not esapiEncoder.encodeForHTMLAttribute
> -----------------------------------------------------------------
>
>                 Key: SIDP-514
>                 URL: https://issues.shibboleth.net/jira/browse/SIDP-514
>             Project: Shibboleth IdP 2 - Java
>          Issue Type: Bug
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: Authentication
>    Affects Versions: 2.3.3
>            Reporter: Rod Widdowson
>            Assignee: Chad La Joie
>   Original Estimate: 1 hour
>  Remaining Estimate: 30 minutes
>
> I spotted this by inspection. 
> Summary has all thr information.  I have a fix made, but it is queued up behind the fix for SIDP-523 (which needs tested)
> This bug probably required SIDP-504 to be present before it fire.
> Security risk is mitigated by the fact that the the data we are spuitting out is in some way "trusted" (if you don't trust your metadata, what do you trust"

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira