From commits-return-46406-apmail-cxf-commits-archive=cxf.apache.org@cxf.apache.org Thu May 18 09:41:47 2017 Return-Path: X-Original-To: apmail-cxf-commits-archive@www.apache.org Delivered-To: apmail-cxf-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id DCFBF1969F for ; Thu, 18 May 2017 09:41:47 +0000 (UTC) Received: (qmail 78926 invoked by uid 500); 18 May 2017 09:41:47 -0000 Delivered-To: apmail-cxf-commits-archive@cxf.apache.org Received: (qmail 78867 invoked by uid 500); 18 May 2017 09:41:47 -0000 Mailing-List: contact commits-help@cxf.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@cxf.apache.org Delivered-To: mailing list commits@cxf.apache.org Received: (qmail 78852 invoked by uid 99); 18 May 2017 09:41:47 -0000 Received: from git1-us-west.apache.org (HELO git1-us-west.apache.org) (140.211.11.23) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 18 May 2017 09:41:47 +0000 Received: by git1-us-west.apache.org (ASF Mail Server at git1-us-west.apache.org, from userid 33) id A878FDFCBE; Thu, 18 May 2017 09:41:47 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: coheigea@apache.org To: commits@cxf.apache.org Message-Id: <5ef1af57c976489a90fbe937d22c4ddb@git.apache.org> X-Mailer: ASF-Git Admin Mailer Subject: cxf-fediz git commit: Escape error messages relating to invalid URIs etc. Date: Thu, 18 May 2017 09:41:47 +0000 (UTC) Repository: cxf-fediz Updated Branches: refs/heads/1.3.x-fixes 386f41b3a -> 7736f28fe Escape error messages relating to invalid URIs etc. Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/7736f28f Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/7736f28f Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/7736f28f Branch: refs/heads/1.3.x-fixes Commit: 7736f28fea0cc85942f552578b049ed7a4e75aab Parents: 386f41b Author: Colm O hEigeartaigh Authored: Thu May 18 10:22:16 2017 +0100 Committer: Colm O hEigeartaigh Committed: Thu May 18 10:41:41 2017 +0100 ---------------------------------------------------------------------- .../fediz/service/oidc/clients/ClientRegistrationService.java | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/7736f28f/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/clients/ClientRegistrationService.java ---------------------------------------------------------------------- diff --git a/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/clients/ClientRegistrationService.java b/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/clients/ClientRegistrationService.java index 90b2aff..b5b51d0 100644 --- a/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/clients/ClientRegistrationService.java +++ b/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/clients/ClientRegistrationService.java @@ -51,6 +51,7 @@ import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; import javax.ws.rs.core.SecurityContext; +import org.apache.commons.lang3.StringEscapeUtils; import org.apache.commons.validator.routines.DomainValidator; import org.apache.commons.validator.routines.DomainValidator.ArrayType; import org.apache.commons.validator.routines.UrlValidator; @@ -315,7 +316,8 @@ public class ClientRegistrationService { for (String uri : allUris) { if (!StringUtils.isEmpty(uri)) { if (!isValidURI(uri, false)) { - return invalidRegistrationResponse("An invalid redirect URI was specified: " + uri); + return invalidRegistrationResponse("An invalid redirect URI was specified: " + + StringEscapeUtils.escapeHtml4(uri)); } redirectUris.add(uri); } @@ -330,7 +332,8 @@ public class ClientRegistrationService { for (String aud : auds) { if (!StringUtils.isEmpty(aud)) { if (!isValidURI(aud, true)) { - return invalidRegistrationResponse("An invalid audience URI was specified: " + aud); + return invalidRegistrationResponse("An invalid audience URI was specified: " + + StringEscapeUtils.escapeHtml4(aud)); } registeredAuds.add(aud); }