[java-identity-provider] 02/02: IDP-2399 - CAS view adjustments

Tue Aug 19 16:00:56 UTC 2025

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=273672f996c3c8722ccc0ffde13aa359e3963fbe

commit 273672f996c3c8722ccc0ffde13aa359e3963fbe
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Aug 19 12:00:51 2025 -0400

    IDP-2399 - CAS view adjustments
    
    Addressed a logout view.
---
 .../net/shibboleth/idp/flows/cas/logout/cas-logoutprop-flow.xml     | 6 ++++--
 .../main/resources/net/shibboleth/idp/views/cas/logoutService.vm    | 6 +++---
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/logout/cas-logoutprop-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/logout/cas-logoutprop-flow.xml
index d21c4ac19..bc78249e6 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/logout/cas-logoutprop-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/logout/cas-logoutprop-flow.xml
@@ -5,8 +5,10 @@
     <view-state id="ShowServiceLogoutView" view="cas/logoutService">
     	<attribute name="csrf_excluded" value="true" type="boolean"/>
         <on-render>
+            <set name="viewScope.xmltext" value="T(com.google.common.xml.XmlEscapers).xmlContentEscaper()" />
+            <set name="viewScope.encoder" value="T(net.shibboleth.shared.codec.HTMLEncoder)" />
             <set name="viewScope.logoutPropCtx"
-                 value="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.session.context.LogoutPropagationContext))" />
+                 value="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.idp.session.context.LogoutPropagationContext))" />
             <set name="viewScope.messageID" value="T(java.util.UUID).randomUUID()" />
             <set name="viewScope.issueInstant" value="T(net.shibboleth.shared.xml.DOMTypeSupport).instantToString(T(java.time.Instant).now())" />
         </on-render>
@@ -16,7 +18,7 @@
     <end-state id="proceed">
         <on-entry>
             <set name="requestScope.logoutPropCtx"
-                 value="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.session.context.LogoutPropagationContext))" />
+                 value="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.idp.session.context.LogoutPropagationContext))" />
             <evaluate expression="logoutPropCtx.setResultString('Success')" />
         </on-entry>
     </end-state>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/cas/logoutService.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/cas/logoutService.vm
index 084c550d8..3bae089be 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/cas/logoutService.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/cas/logoutService.vm
@@ -2,14 +2,14 @@
 <html>
 <head>
     <meta charset="utf-8">
-    <title>Logout of $logoutPropCtx.session.id</title>
+    <title>Logout of $encoder.encodeForHTML($logoutPropCtx.session.id)</title>
 </head>
 <body onload="document.getElementById('logout_prop').submit()">
-<form id="logout_prop" method="POST" action="$logoutPropCtx.session.serviceURL">
+<form id="logout_prop" method="POST" action="$encoder.encodeForHTMLAttribute($logoutPropCtx.session.serviceURL)">
     <input type="hidden" name="logoutRequest" value="
         <samlp:LogoutRequest xmlns:samlp='urn:oasis:names:tc:SAML:2.0:protocol' ID='$messageID' Version='2.0' IssueInstant='$issueInstant'>
         <saml:NameID xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion'>somebody</saml:NameID>
-        <samlp:SessionIndex>$logoutPropCtx.session.ticketId</samlp:SessionIndex>
+        <samlp:SessionIndex>$xmltext.escape($logoutPropCtx.session.ticketId)</samlp:SessionIndex>
         </samlp:LogoutRequest>" >
     <button id="logout" name="logout" type="submit">Logout</button>
 </form>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
