[java-centralized-discovery COMMIT] /branches/REL_1/src/main/webapp/wayf.jsp

[noreply at shibboleth.net]

Author: rdw
Date: Tue Mar 13 10:48:38 2012
New Revision: 2212

URL: http://svn.shibboleth.net/view/java-centralized-discovery?rev=2212&view=rev
Log:
SDSJ105  More escaping.  Probably needless but belt and braces.

Modified:
    branches/REL_1/src/main/webapp/wayf.jsp

Modified: branches/REL_1/src/main/webapp/wayf.jsp
URL: http://svn.shibboleth.net/view/java-centralized-discovery/branches/REL_1/src/main/webapp/wayf.jsp?rev=2212&r1=2211&r2=2212&view=diff
==============================================================================
--- branches/REL_1/src/main/webapp/wayf.jsp (original)
+++ branches/REL_1/src/main/webapp/wayf.jsp Tue Mar 13 10:48:38 2012
@@ -190,7 +190,8 @@
                 <bean:define id="ei" name="entityID" />
                 <bean:define id="re" name="returnX"/>
 
-                 <a tabindex="10" href="<bean:write name="requestURL" />?entityID=<%= java.net.URLEncoder.encode(ei.toString(), "utf-8") %>&return=<%= java.net.URLEncoder.encode(re.toString(), "utf-8") %>&returnIDxParam=<%= java.net.URLEncoder.encode( returnIDParam.toString(), "utf-8" ) %>&cache=perm&action=selection&origin=<%=java.net.URLEncoder.encode(((IdPSite)site).getName())%>
+                 <a tabindex="10" href="
+<esapi:encodeForHTMLAttribute><bean:write name="requestURL" /></esapi:encodeForHTMLAttribute>?entityID=<%= java.net.URLEncoder.encode(ei.toString(), "utf-8") %>&return=<%= java.net.URLEncoder.encode(re.toString(), "utf-8") %>&returnIDxParam=<%= java.net.URLEncoder.encode( returnIDParam.toString(), "utf-8" ) %>&cache=perm&action=selection&origin=<%=java.net.URLEncoder.encode(((IdPSite)site).getName())%>
 ">
                     <esapi:encodeForHTML><jsp:getProperty name="site" property="displayName" /></esapi:encodeForHTML>
                 </a>
@@ -199,7 +200,7 @@
                 <bean:define id="targ" name="target" />
                 <bean:define id="shire" name="shire" />
                 <bean:define id="pid" name="providerId" />
-                <a tabindex="10" href="<bean:write name="requestURL" />?target=<%= java.net.URLEncoder.encode(targ.toString(),"utf-8") %>&shire=<%= java.net.URLEncoder.encode(shire.toString(),"utf-8") %>&providerId=<%= java.net.URLEncoder.encode(pid.toString(),"utf-8") %>&time=<bean:write name="time" />&cache=perm&action=selection&origin=<%=java.net.URLEncoder.encode(((IdPSite)site).getName())%> ">
+                <a tabindex="10" href="<esapi:encodeForHTMLAttribute><bean:write name="requestURL" /></esapi:encodeForHTMLAttribute>?target=<%= java.net.URLEncoder.encode(targ.toString(),"utf-8") %>&shire=<%= java.net.URLEncoder.encode(shire.toString(),"utf-8") %>&providerId=<%= java.net.URLEncoder.encode(pid.toString(),"utf-8") %>&time=<esapi:encodeForHTMLAttribute><bean:write name="time" /></esapi:encodeForHTMLAttribute>&cache=perm&action=selection&origin=<%=java.net.URLEncoder.encode(((IdPSite)site).getName())%> ">
                     <esapi:encodeForHTML><jsp:getProperty name="site" property="displayName" /></esapi:encodeForHTML>
                 </a>
               </logic:notPresent>
@@ -218,17 +219,17 @@
         <form method="get" action="ClearCache.wayf" >
           <div>
           <logic:notPresent name="entityID" scope="request">
-            <input type="hidden" name="shire" value="<bean:write name="shire" />" />
-            <input type="hidden" name="target" value="<bean:write name="target" />" />
-            <input type="hidden" name="providerId" value="<bean:write name="providerId" />" />
+            <input type="hidden" name="shire" value="<esapi:encodeForHTMLAttribute><bean:write name="shire" /></esapi:encodeForHTMLAttribute>" />
+            <input type="hidden" name="target" value="<esapi:encodeForHTMLAttribute><bean:write name="target" /></esapi:encodeForHTMLAttribute>" />
+            <input type="hidden" name="providerId" value="<esapi:encodeForHTMLAttribute><bean:write name="providerId" /></esapi:encodeForHTMLAttribute>" />
             <logic:present name="time" scope="request">
-               <input type="hidden" name="time" value="<bean:write name="time" />" />
+               <input type="hidden" name="time" value="<esapi:encodeForHTMLAttribute><bean:write name="time" /></esapi:encodeForHTMLAttribute>" />
             </logic:present>
           </logic:notPresent>
           <logic:present name="entityID" scope="request">
-            <input type="hidden" name="entityID" value="<bean:write name="entityID" />" />
-            <input type="hidden" name="returnX" value="<bean:write name="returnX" />" />
-            <input type="hidden" name="returnIDParam" value="<bean:write name="returnIDParam" />" />
+            <input type="hidden" name="entityID" value="<esapi:encodeForHTMLAttribute><bean:write name="entityID" /></esapi:encodeForHTMLAttribute>" />
+            <input type="hidden" name="returnX" value="<esapi:encodeForHTMLAttribute><bean:write name="returnX" /></esapi:encodeForHTMLAttribute>" />
+            <input type="hidden" name="returnIDParam" value="<esapi:encodeForHTMLAttribute><bean:write name="returnIDParam" /></esapi:encodeForHTMLAttribute>" />

[... 206 lines stripped ...]