From commits-return-50590-archive-asf-public=cust-asf.ponee.io@cxf.apache.org  Tue Dec  4 15:45:20 2018
Return-Path: <commits-return-50590-archive-asf-public=cust-asf.ponee.io@cxf.apache.org>
X-Original-To: archive-asf-public@cust-asf.ponee.io
Delivered-To: archive-asf-public@cust-asf.ponee.io
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by mx-eu-01.ponee.io (Postfix) with SMTP id 2D354180652
	for <archive-asf-public@cust-asf.ponee.io>; Tue,  4 Dec 2018 15:45:20 +0100 (CET)
Received: (qmail 61244 invoked by uid 500); 4 Dec 2018 14:45:19 -0000
Mailing-List: contact commits-help@cxf.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:commits-help@cxf.apache.org>
List-Unsubscribe: <mailto:commits-unsubscribe@cxf.apache.org>
List-Post: <mailto:commits@cxf.apache.org>
List-Id: <commits.cxf.apache.org>
Reply-To: dev@cxf.apache.org
Delivered-To: mailing list commits@cxf.apache.org
Received: (qmail 61235 invoked by uid 99); 4 Dec 2018 14:45:19 -0000
Received: from ec2-52-202-80-70.compute-1.amazonaws.com (HELO gitbox.apache.org) (52.202.80.70)
    by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 04 Dec 2018 14:45:19 +0000
Received: by gitbox.apache.org (ASF Mail Server at gitbox.apache.org, from userid 33)
	id 8880989B44; Tue,  4 Dec 2018 14:45:18 +0000 (UTC)
Date: Tue, 04 Dec 2018 14:45:18 +0000
To: "commits@cxf.apache.org" <commits@cxf.apache.org>
Subject: [cxf-fediz] branch 1.4.x-fixes updated: FEDIZ-234 - Escape logging
 output in LoginHintHomeRealmDiscovery
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Message-ID: <154393471850.19173.3457965322602299823@gitbox.apache.org>
From: coheigea@apache.org
X-Git-Host: gitbox.apache.org
X-Git-Repo: cxf-fediz
X-Git-Refname: refs/heads/1.4.x-fixes
X-Git-Reftype: branch
X-Git-Oldrev: 1fb09bfe16d6acf818936758bdf7e77f4c1105fc
X-Git-Newrev: 1a8925efae1385092604d25758829756460a4625
X-Git-Rev: 1a8925efae1385092604d25758829756460a4625
X-Git-NotificationType: ref_changed_plus_diff
X-Git-Multimail-Version: 1.5.dev
Auto-Submitted: auto-generated

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 1.4.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf-fediz.git


The following commit(s) were added to refs/heads/1.4.x-fixes by this push:
     new 1a8925e  FEDIZ-234 - Escape logging output in LoginHintHomeRealmDiscovery
1a8925e is described below

commit 1a8925efae1385092604d25758829756460a4625
Author: Colm O hEigeartaigh <coheigea@apache.org>
AuthorDate: Tue Dec 4 14:28:05 2018 +0000

    FEDIZ-234 - Escape logging output in LoginHintHomeRealmDiscovery
---
 pom.xml                                                            | 1 +
 services/oidc/pom.xml                                              | 5 +++++
 .../service/oidc/handler/hrd/LoginHintHomeRealmDiscovery.java      | 7 ++++---
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index 8c61085..cbcbba8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -43,6 +43,7 @@
         <commons.lang.version>3.5</commons.lang.version>
         <commons.logging.version>1.2</commons.logging.version>
         <commons.io.version>2.5</commons.io.version>
+        <commons.text.version>1.6</commons.text.version>
         <commons.validator.version>1.6</commons.validator.version>
         <cxf.version>3.1.17</cxf.version>
         <cxf.build-utils.version>3.2.0</cxf.build-utils.version>
diff --git a/services/oidc/pom.xml b/services/oidc/pom.xml
index f0e51bc..5664e0a 100644
--- a/services/oidc/pom.xml
+++ b/services/oidc/pom.xml
@@ -82,6 +82,11 @@
             <artifactId>commons-lang3</artifactId>
             <version>${commons.lang.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-text</artifactId>
+            <version>${commons.text.version}</version>
+        </dependency>
         <!--
         <dependency>
             <groupId>org.apache.geronimo.specs</groupId>
diff --git a/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/handler/hrd/LoginHintHomeRealmDiscovery.java b/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/handler/hrd/LoginHintHomeRealmDiscovery.java
index 52363f4..f9b7942 100644
--- a/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/handler/hrd/LoginHintHomeRealmDiscovery.java
+++ b/services/oidc/src/main/java/org/apache/cxf/fediz/service/oidc/handler/hrd/LoginHintHomeRealmDiscovery.java
@@ -24,6 +24,7 @@ import javax.security.auth.callback.Callback;
 import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.callback.UnsupportedCallbackException;
 
+import org.apache.commons.text.StringEscapeUtils;
 import org.apache.cxf.fediz.core.spi.HomeRealmCallback;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -49,10 +50,10 @@ public class LoginHintHomeRealmDiscovery implements CallbackHandler {
                 } else {
                     String[] homeRealm = loginHint.split("@");
                     if (homeRealm.length == 2) {
-                        LOG.debug("Home realm '{}' found in request", homeRealm[1]);
+                        LOG.debug("Home realm '{}' found in request", StringEscapeUtils.escapeHtml4(homeRealm[1]));
                         callback.setHomeRealm(homeRealm[1]);
                     } else {
-                        LOG.warn("login_hint is not an email address: {}", loginHint);
+                        LOG.warn("login_hint is not an email address: {}", StringEscapeUtils.escapeHtml4(loginHint));
                     }
                 }
             } else {
@@ -61,4 +62,4 @@ public class LoginHintHomeRealmDiscovery implements CallbackHandler {
         }
     }
 
-}
\ No newline at end of file
+}