[java-centralized-discovery COMMIT] in /branches/REL_1/src/main: java/edu/internet2/middleware/shibboleth/wayf/Discov...

[noreply at shibboleth.net]

Author: rdw
Date: Wed Mar  7 10:43:40 2012
New Revision: 2204

URL: http://svn.shibboleth.net/view/java-centralized-discovery?rev=2204&view=rev
Log:
Case SDSJ-103.  Properly escape javascript strings (code derived from SP

Modified:
    branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/wayf/DiscoveryServiceHandler.java
    branches/REL_1/src/main/webapp/wayf.jsp

Modified: branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/wayf/DiscoveryServiceHandler.java
URL: http://svn.shibboleth.net/view/java-centralized-discovery/branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/wayf/DiscoveryServiceHandler.java?rev=2204&r1=2203&r2=2204&view=diff
==============================================================================
--- branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/wayf/DiscoveryServiceHandler.java (original)
+++ branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/wayf/DiscoveryServiceHandler.java Wed Mar  7 10:43:40 2012
@@ -840,12 +840,12 @@
 
             if (null == returnUrl || 0 == returnUrl.length()) {
                 throw new WayfException("Could not find return parameter");
-            }
+            }/*
             try {
                 returnUrl = URLDecoder.decode(returnUrl, "UTF-8");
             } catch (UnsupportedEncodingException e) {
                 throw new WayfException("Did not understand parameter ", e);
-            }
+            }*/
             String redirect;
             if (site != null) {
                 StringBuffer buffer = new StringBuffer(returnUrl);

Modified: branches/REL_1/src/main/webapp/wayf.jsp
URL: http://svn.shibboleth.net/view/java-centralized-discovery/branches/REL_1/src/main/webapp/wayf.jsp?rev=2204&r1=2203&r2=2204&view=diff
==============================================================================
--- branches/REL_1/src/main/webapp/wayf.jsp (original)
+++ branches/REL_1/src/main/webapp/wayf.jsp Wed Mar  7 10:43:40 2012
@@ -8,8 +8,56 @@
 <%@ taglib uri="/WEB-INF/tlds/struts-logic.tld" prefix="logic" %>
 <%@ taglib uri="/WEB-INF/tlds/struts-bean.tld" prefix="bean" %>
 
+<%! StringBuilder jsSafe(String input) {
+  StringBuilder out = new StringBuilder();
+  int index;
+  char ch;
+  for (index = 0; index < input.length(); index++) {
+    ch = input.charAt(index);
+      switch(ch) {
+        case '"' :
+        case '\\' :
+          out.append('\\').append(ch);
+          break;
+
+        case '\n':
+        case '\r':
+          break;
+       
+        case '\t' :
+          out.append("\\t");
+          break;
+
+        case '\f' :
+          out.append("\\f");
+          break;
+
+        case '\b' :
+          out.append("\\b");
+          break;
+
+        default :
+          out.append(ch);
+          break;
+      }
+  }
+  return out;
+}
+
+String getJsForEntity(IdPSite site)
+{
+  StringBuilder out = new StringBuilder(9+site.getDisplayName().length()+site.getName().length());
+  out.append("[\"");
+  out.append(jsSafe(site.getDisplayName())).append("\",\"");
+  out.append(jsSafe(site.getName())).append("\"],");
+  return out.toString();
+
+}
+%>
+
 <%request.setCharacterEncoding("UTF-8");%>
 <%response.setCharacterEncoding("UTF-8");%>
+
 
 <logic:present name="showComments" scope="Request">
 
@@ -632,10 +680,7 @@
 
 
 var theElements = [
-  <logic:iterate id="site" name="sites">
-     ["<%= ((edu.internet2.middleware.shibboleth.wayf.IdPSite)site).getDisplayName().replace("\n","").toString() %>",
-      "<jsp:getProperty name="site" property="name" />"],
-  </logic:iterate>
+  <logic:iterate id="site" name="sites"><%=getJsForEntity((edu.internet2.middleware.shibboleth.wayf.IdPSite)site)%></logic:iterate>
  ];
 
 -->