[java-identity-provider] branch master updated: IDP-1437 - CAS: Unicode SMP characters cause invalid XML

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=5b45689431abe32c37487f8874b09d8b638a4a0c

The following commit(s) were added to refs/heads/master by this push:
       new  5b45689   IDP-1437 - CAS: Unicode SMP characters cause invalid XML
5b45689 is described below

commit 5b45689431abe32c37487f8874b09d8b638a4a0c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 16 13:28:01 2020 -0400

    IDP-1437 - CAS: Unicode SMP characters cause invalid XML
    
    https://issues.shibboleth.net/jira/browse/IDP-1437
---
 idp-conf/src/main/resources/system/flows/cas/proxy/proxy-flow.xml | 2 +-
 .../main/resources/system/flows/cas/validate-abstract-flow.xml    | 2 +-
 idp-conf/src/main/resources/system/views/cas/proxySuccess.vm      | 2 +-
 idp-conf/src/main/resources/system/views/cas/validateSuccess.vm   | 8 ++++----
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/idp-conf/src/main/resources/system/flows/cas/proxy/proxy-flow.xml b/idp-conf/src/main/resources/system/flows/cas/proxy/proxy-flow.xml
index 2ba28db..710170b 100644
--- a/idp-conf/src/main/resources/system/flows/cas/proxy/proxy-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/cas/proxy/proxy-flow.xml
@@ -60,7 +60,7 @@
             <evaluate expression="PopulateAuditContext" />
             <evaluate expression="WriteAuditLog" />
             <evaluate expression="PublishProtocolResponse" />
-            <set name="flashScope.escapeUtils" value="T(org.apache.commons.lang.StringEscapeUtils)" />
+            <set name="flashScope.xmlContentEscaper" value="T(com.google.common.xml.XmlEscapers).xmlContentEscaper()" />
         </on-entry>
     </end-state>
 
diff --git a/idp-conf/src/main/resources/system/flows/cas/validate-abstract-flow.xml b/idp-conf/src/main/resources/system/flows/cas/validate-abstract-flow.xml
index 56eb792..03228e8 100644
--- a/idp-conf/src/main/resources/system/flows/cas/validate-abstract-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/cas/validate-abstract-flow.xml
@@ -103,7 +103,7 @@
             <evaluate expression="PopulateAuditContext" />
             <evaluate expression="WriteAuditLog" />
             <evaluate expression="PublishProtocolResponse" />
-            <set name="flashScope.escapeUtils" value="T(org.apache.commons.lang.StringEscapeUtils)" />
+            <set name="flashScope.xmlContentEscaper" value="T(com.google.common.xml.XmlEscapers).xmlContentEscaper()" />
         </on-entry>
     </end-state>
 
diff --git a/idp-conf/src/main/resources/system/views/cas/proxySuccess.vm b/idp-conf/src/main/resources/system/views/cas/proxySuccess.vm
index b835679..f681aca 100644
--- a/idp-conf/src/main/resources/system/views/cas/proxySuccess.vm
+++ b/idp-conf/src/main/resources/system/views/cas/proxySuccess.vm
@@ -1,5 +1,5 @@
 #include("cas/header.vm")
   <cas:proxySuccess>
-    <cas:proxyTicket>$escapeUtils.escapeXml($proxyTicketResponse.pt)</cas:proxyTicket>
+    <cas:proxyTicket>$xmlContentEscaper.escape($proxyTicketResponse.pt)</cas:proxyTicket>
   </cas:proxySuccess>
 #include("cas/footer.vm")
diff --git a/idp-conf/src/main/resources/system/views/cas/validateSuccess.vm b/idp-conf/src/main/resources/system/views/cas/validateSuccess.vm
index 5a9b0a4..44535b1 100644
--- a/idp-conf/src/main/resources/system/views/cas/validateSuccess.vm
+++ b/idp-conf/src/main/resources/system/views/cas/validateSuccess.vm
@@ -1,14 +1,14 @@
 #include("cas/header.vm")
   <cas:authenticationSuccess>
-    <cas:user>$escapeUtils.escapeXml($ticketValidationResponse.userName)</cas:user>
+    <cas:user>$xmlContentEscaper.escape($ticketValidationResponse.userName)</cas:user>
     #if($ticketValidationResponse.pgtIou)
-      <cas:proxyGrantingTicket>$escapeUtils.escapeXml($ticketValidationResponse.pgtIou)</cas:proxyGrantingTicket>
+      <cas:proxyGrantingTicket>$xmlContentEscaper.escape($ticketValidationResponse.pgtIou)</cas:proxyGrantingTicket>
     #end
     #if(!$ticketValidationResponse.attributes.isEmpty())
       <cas:attributes>
         #foreach($attr in $ticketValidationResponse.attributes)
           #foreach($value in $$attr.values)
-            <cas:$escapeUtils.escapeXml($attr.name)>$escapeUtils.escapeXml($value)</cas:$escapeUtils.escapeXml($attr.name)>
+            <cas:$xmlContentEscaper.escape($attr.name)>$xmlContentEscaper.escape($value)</cas:$xmlContentEscaper.escape($attr.name)>
           #end
         #end
       </cas:attributes>
@@ -16,7 +16,7 @@
     #if($ticketValidationResponse.proxies.size() > 0)
       <cas:proxies>
         #foreach($proxy in $ticketValidationResponse.proxies)
-          <cas:proxy>$escapeUtils.escapeXml($proxy)</cas:proxy>
+          <cas:proxy>$xmlContentEscaper.escape($proxy)</cas:proxy>
         #end
       </cas:proxies>
     #end

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.