[java-centralized-discovery COMMIT] in /branches/REL_1/src/main/webapp: WEB-INF/tlds/esapi.tld wayf.jsp

[noreply at shibboleth.net]

Author: rdw
Date: Wed Mar  7 14:56:26 2012
New Revision: 2206

URL: http://svn.shibboleth.net/view/java-centralized-discovery?rev=2206&view=rev
Log:
SDSJ105.  Encode with ESAPI.  Add further escaping of both GTML and JAvaScript

Added:
    branches/REL_1/src/main/webapp/WEB-INF/tlds/esapi.tld
Modified:
    branches/REL_1/src/main/webapp/wayf.jsp

Modified: branches/REL_1/src/main/webapp/wayf.jsp
URL: http://svn.shibboleth.net/view/java-centralized-discovery/branches/REL_1/src/main/webapp/wayf.jsp?rev=2206&r1=2205&r2=2206&view=diff
==============================================================================
--- branches/REL_1/src/main/webapp/wayf.jsp (original)
+++ branches/REL_1/src/main/webapp/wayf.jsp Wed Mar  7 14:56:26 2012
@@ -7,53 +7,7 @@
 
 <%@ taglib uri="/WEB-INF/tlds/struts-logic.tld" prefix="logic" %>
 <%@ taglib uri="/WEB-INF/tlds/struts-bean.tld" prefix="bean" %>
-
-<%! StringBuilder jsSafe(String input) {
-  StringBuilder out = new StringBuilder();
-  int index;
-  char ch;
-  for (index = 0; index < input.length(); index++) {
-    ch = input.charAt(index);
-      switch(ch) {
-        case '"' :
-        case '\\' :
-          out.append('\\').append(ch);
-          break;
-
-        case '\n':
-        case '\r':
-          break;
-       
-        case '\t' :
-          out.append("\\t");
-          break;
-
-        case '\f' :
-          out.append("\\f");
-          break;
-
-        case '\b' :
-          out.append("\\b");
-          break;
-
-        default :
-          out.append(ch);
-          break;
-      }
-  }
-  return out;
-}
-
-String getJsForEntity(IdPSite site)
-{
-  StringBuilder out = new StringBuilder(9+site.getDisplayName().length()+site.getName().length());
-  out.append("[\"");
-  out.append(jsSafe(site.getDisplayName())).append("\",\"");
-  out.append(jsSafe(site.getName())).append("\"],");
-  return out.toString();
-
-}
-%>
+<%@ taglib uri="/WEB-INF/tlds/esapi.tld" prefix="esapi" %>
 
 <%request.setCharacterEncoding("UTF-8");%>
 <%response.setCharacterEncoding("UTF-8");%>
@@ -238,16 +192,15 @@
 
                  <a tabindex="10" href="<bean:write name="requestURL" />?entityID=<%= java.net.URLEncoder.encode(ei.toString(), "utf-8") %>&return=<%= java.net.URLEncoder.encode(re.toString(), "utf-8") %>&returnIDxParam=<%= java.net.URLEncoder.encode( returnIDParam.toString(), "utf-8" ) %>&cache=perm&action=selection&origin=<%=java.net.URLEncoder.encode(((IdPSite)site).getName())%>
 ">
-                    <jsp:getProperty name="site" property="displayName" />
+                    <esapi:encodeForHTML><jsp:getProperty name="site" property="displayName" /></esapi:encodeForHTML>
                 </a>
               </logic:present>
               <logic:notPresent name="entityID" scope="request">
                 <bean:define id="targ" name="target" />
                 <bean:define id="shire" name="shire" />
                 <bean:define id="pid" name="providerId" />
-                <a tabindex="10" href="<bean:write name="requestURL" />?target=<%= java.net.URLEncoder.encode(targ.toString(),"utf-8") %>&shire=<%= java.net.URLEncoder.encode(shire.toString(),"utf-8") %>&providerId=<%= java.net.URLEncoder.encode(pid.toString(),"utf-8") %>&time=<bean:write name="time" />&cache=perm&action=selection&origin=<%=java.net.URLEncoder.encode(((IdPSite)site).getName())%>
-                    <jsp:getProperty name="site"
-                    property="displayName" />
+                <a tabindex="10" href="<bean:write name="requestURL" />?target=<%= java.net.URLEncoder.encode(targ.toString(),"utf-8") %>&shire=<%= java.net.URLEncoder.encode(shire.toString(),"utf-8") %>&providerId=<%= java.net.URLEncoder.encode(pid.toString(),"utf-8") %>&time=<bean:write name="time" />&cache=perm&action=selection&origin=<%=java.net.URLEncoder.encode(((IdPSite)site).getName())%> ">
+                    <esapi:encodeForHTML><jsp:getProperty name="site" property="displayName" /></esapi:encodeForHTML>
                 </a>
               </logic:notPresent>
             </p>
@@ -353,8 +306,8 @@
                  <input type="hidden" name="action" value="selection" />
                  <select name="origin" id="hackForie6" tabindex="40">      
                      <logic:iterate id="site" name="sites">
-                         <option value="<jsp:getProperty name="site" property="name" />">
-                             <jsp:getProperty name="site" property="displayName" />
+                         <option value="<esapi:encodeForHTML><jsp:getProperty name="site" property="name" /></esapi:encodeForHTML>">
+                             <esapi:encodeForHTML><jsp:getProperty name="site" property="displayName" /></esapi:encodeForHTML>
                          </option>
                      </logic:iterate>
                  </select>
@@ -417,13 +370,13 @@
 
                        <!-- Only One site so select it -->
 
-                       <option value="<jsp:getProperty name="siteset" property="name"/>" selected="selected">
-                         <jsp:getProperty name="siteset" property="name"/>

[... 94 lines stripped ...]