This is an automated email from the ASF dual-hosted git repository. kwin pushed a commit to branch bugfix/escape-webconsole-plugin in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-commons-crypto.git
commit cd8267415ef47e7ea238a176bf27ac119b9bec8d Author: Konrad Windszus <[email protected]> AuthorDate: Sun Sep 13 12:56:05 2026 +0200 SLING-13343 Escape dynamic values in Web Console pluginn --- .../commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/main/java/org/apache/sling/commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java b/src/main/java/org/apache/sling/commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java index e2587b8..daf8c2f 100644 --- a/src/main/java/org/apache/sling/commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java +++ b/src/main/java/org/apache/sling/commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java @@ -98,7 +98,7 @@ public final class EncryptWebConsolePlugin extends HttpServlet { if (Objects.nonNull(forwardRequestUri) && forwardRequestUri.equals(request.getRequestURI())) { final String ciphertext = (String) request.getAttribute(ATTRIBUTE_CIPHERTEXT); if (Objects.nonNull(ciphertext)) { - final String html = String.format("<p id=\"ciphertext\">Encrypted message: %s</p>", ciphertext); + final String html = String.format("<p id=\"ciphertext\">Encrypted message: %s</p>", JcaProviderAlgorithmsWebConsolePlugin.escapeHtml(ciphertext)); writer.println(html); } } @@ -159,8 +159,8 @@ public final class EncryptWebConsolePlugin extends HttpServlet { CryptoService service = findCryptoService(id); final String algorithm = Objects.toString(service.getAlgorithmDescription(), ""); final String label = String.format("Service id %s (%s), names: %s, algorithm(s): %s", id, description, Arrays.toString(names), algorithm); - builder.append("<option value=\"").append(id).append("\">"); - builder.append(label); + builder.append("<option value=\"").append(JcaProviderAlgorithmsWebConsolePlugin.escapeHtml(id)).append("\">"); + builder.append(JcaProviderAlgorithmsWebConsolePlugin.escapeHtml(label)); builder.append("</option>"); } builder.append("</label>");
