[java-idp-oidc] 03/04: Encode all parameter values with HTMLEncoder.encodeForHTMLAttribute.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch maint-4.3
in repository java-idp-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-oidc/commit/fe70307e297e9c74cc2095b63242b1c09b690130

commit fe70307e297e9c74cc2095b63242b1c09b690130
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Nov 5 15:42:49 2026 +0200

    Encode all parameter values with HTMLEncoder.encodeForHTMLAttribute.
---
 .../idp/plugin/oidc/op/encoding/impl/NimbusResponseEncoder.java         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/NimbusResponseEncoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/NimbusResponseEncoder.java
index c9c5954c..e85fe37a 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/NimbusResponseEncoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/encoding/impl/NimbusResponseEncoder.java
@@ -164,7 +164,7 @@ public class NimbusResponseEncoder extends AbstractHttpServletResponseMessageEnc
     private VelocityContext doPostEncode(@Nonnull final AuthorizationResponse message) {
         final VelocityContext context = new VelocityContext();
         for (final Entry<String, List<String>> entry : message.toParameters().entrySet()) {
-            context.put("parameter_" + entry.getKey(), entry.getValue().get(0));
+            context.put("parameter_" + entry.getKey(), HTMLEncoder.encodeForHTMLAttribute(entry.getValue().get(0)));
         }
         context.put("action", HTMLEncoder.encodeForHTMLAttribute(message.getRedirectionURI().toString()));
         if (cspDigester != null) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.