You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2026/08/24 08:32:50 UTC
(syncope) branch 4_0_X updated: Ensuring to properly escape the notification message
This is an automated email from the ASF dual-hosted git repository.
ilgrosso pushed a commit to branch 4_0_X
in repository https://gitbox.apache.org/repos/asf/syncope.git
The following commit(s) were added to refs/heads/4_0_X by this push:
new 967ef736c3 Ensuring to properly escape the notification message
967ef736c3 is described below
commit 967ef736c34a54a02a14448df24fec43e4e20b24
Author: Francesco Chicchiriccò <il...@apache.org>
AuthorDate: Mon Aug 24 10:32:16 2026 +0200
Ensuring to properly escape the notification message
---
.../main/java/org/apache/syncope/client/ui/commons/BaseLogin.java | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java
index 8b78101b03..45641e4a81 100644
--- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java
+++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java
@@ -199,7 +199,10 @@ public abstract class BaseLogin extends WebPage {
if (StringUtils.isNotBlank(notificationMessage)) {
response.render(OnLoadHeaderItem.forScript(StyledNotificationBehavior.jQueryShow(
- StringEscapeUtils.escapeEcmaScript(notificationMessage),
+ StringEscapeUtils.escapeHtml4(
+ StringEscapeUtils.escapeHtml3(
+ StringEscapeUtils.escapeJson(
+ StringEscapeUtils.escapeEcmaScript(notificationMessage)))),
"jQuery('#%s').data('kendoNotification')".formatted(notificationPanel.getNotificationMarkupId()),
notificationLevel)));
}