mirror/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-05-08 08:01:18 -05:00
Code Issues Packages Projects Releases Wiki Activity

Escape action in the form_post response mode (#30)

Browse Source 
Closes https://issues.redhat.com/browse/RHBK-652

Signed-off-by: rmartinc <rmartinc@redhat.com>
This commit is contained in:
Ricardo Martin
2023-12-06 16:14:44 +01:00
committed by GitHub
parent 15a21bf8e4
commit 67f905ecc5
6 changed files with 72 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/src/main/java/org/keycloak/protocol/oidc/utils/OIDCRedirectUriBuilder.java
+3 -1
View File
@@ -160,7 +160,9 @@ public abstract class OIDCRedirectUriBuilder {
builder.append(" </HEAD>");
builder.append(" <BODY Onload=\"document.forms[0].submit()\">");
builder.append(" <FORM METHOD=\"POST\" ACTION=\"" + redirectUri.toString() + "\">");
builder.append(" <FORM METHOD=\"POST\" ACTION=\"")
.append(HtmlUtils.escapeAttribute(redirectUri.toString()))
.append("\">");
for (Map.Entry<String, String> param : params.entrySet()) {
builder.append(" <INPUT TYPE=\"HIDDEN\" NAME=\"")