fix(jans-auth-server): escape login_hint before rendering

GluuFederation/oxAuth#1657
JanssenProject · Mar 31, 2022 · e1a682a · e1a682a
1 parent 2f2f82c
commit e1a682a
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeAction.java
@@ -49,6 +49,7 @@
 import io.jans.util.StringHelper;
 import io.jans.util.ilocale.LocaleUtil;
 import org.apache.commons.lang.StringUtils;
+import org.apache.commons.text.StringEscapeUtils;
 import org.apache.logging.log4j.util.Strings;
 import org.slf4j.Logger;
 
@@ -735,7 +736,7 @@ public String getLoginHint() {
     }
 
     public void setLoginHint(String loginHint) {
-        this.loginHint = loginHint;
+        this.loginHint = StringEscapeUtils.escapeEcmaScript(loginHint);
     }
 
     public String getAcrValues() {

diff --git a/jans-auth-server/server/src/main/webapp/login.xhtml b/jans-auth-server/server/src/main/webapp/login.xhtml
@@ -7,7 +7,6 @@
 	template="/WEB-INF/incl/layout/login-template.xhtml">
 	<f:metadata>
 		<f:viewAction action="#{authenticator.prepareAuthenticationForStep}" />
-		<f:viewParam name="login_hint" value="#{authorizeAction.loginHint}" />
 	</f:metadata>
 	<ui:define name="head">
 		<meta name="description" content="Gluu, Inc." />