[java-oidc-common] branch dev/JCOMOIDC-41 updated: Add HTML encoding to form parameters

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=dc53602927b90a0ee1fd3bb6934831e238d8f075

The following commit(s) were added to refs/heads/dev/JCOMOIDC-41 by this push:
     new dc53602  Add HTML encoding to form parameters
dc53602 is described below

commit dc53602927b90a0ee1fd3bb6934831e238d8f075
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Jul 21 14:10:05 2022 +0100

    Add HTML encoding to form parameters
---
 .../oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java         | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java
index e639e05..1485925 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java
@@ -42,6 +42,7 @@ import net.shibboleth.utilities.java.support.collection.Pair;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.net.HttpServletSupport;
+import net.shibboleth.utilities.java.support.net.URISupport;
 
 /**
  * A {@link MessageEncoder message encoder} that encodes an OpenID authentication request by
@@ -106,7 +107,7 @@ public class HTTPPostAuthnRequestEncoder extends AbstractOIDCMessageEncoder {
                                                                 throws MessageEncodingException {
         final VelocityContext context = new VelocityContext();
         final List<Pair<String, String>> params = createParametersFromRequest(request);
-        params.forEach(param -> context.put(param.getFirst(), param.getSecond()));
+        params.forEach(param -> context.put(param.getFirst(),HTMLEncoder.encodeForHTML(param.getSecond())));
         context.put("action", HTMLEncoder.encodeForHTMLAttribute(request.getEndpointURI().toString()));
         log.trace("Velocity context {}", params);
         return context;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.