Question concerning login.jsp

[Brewer, Edward L]

>Umm, I don't want to alarm you, but that looks like a XSS attack waiting to happen. You shouldn't be controlling the form action with something that can be fed in externally.

Scott,

Would this change to the login-mobile.jsp be a safe fix? 


        <% if(request.getParameter("actionUrl") != null){ %>
                    <form action="/idp/Authn/userPassword" method="post">
                <% }else{ %>
                    <form action="j_security_check" method="post">
                <% } %>

Thanks,
Lee Brewer