(shiro) 01/08: bugfix: html-encode text in PrincipalTag

[lprimak]

This is an automated email from the ASF dual-hosted git repository.

lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git

commit 180d480b07b5aeca51370bd63f3966f61e8cabdc
Author: lprimak <le...@flowlogix.com>
AuthorDate: Wed Oct 21 11:11:42 2026 -0500

    bugfix: html-encode text in PrincipalTag
---
 .../src/main/java/org/apache/shiro/ee/faces/tags/PrincipalTag.java   | 2 +-
 web/src/main/java/org/apache/shiro/web/tags/PrincipalTag.java        | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git 
a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/faces/tags/PrincipalTag.java
 
b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/faces/tags/PrincipalTag.java
index 560c10e6c..a8974ac3f 100644
--- 
a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/faces/tags/PrincipalTag.java
+++ 
b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/faces/tags/PrincipalTag.java
@@ -99,7 +99,7 @@ public class PrincipalTag extends SecureComponent {
         // Print out the principal value if not null
         if (strValue != null) {
             try {
-                ctx.getResponseWriter().write(strValue);
+                ctx.getResponseWriter().writeText(strValue, null);
             } catch (IOException e) {
                 throw new IOException("Error writing [" + strValue + "] to 
output.");
             }
diff --git a/web/src/main/java/org/apache/shiro/web/tags/PrincipalTag.java 
b/web/src/main/java/org/apache/shiro/web/tags/PrincipalTag.java
index 9afe1eae2..334904280 100644
--- a/web/src/main/java/org/apache/shiro/web/tags/PrincipalTag.java
+++ b/web/src/main/java/org/apache/shiro/web/tags/PrincipalTag.java
@@ -18,6 +18,7 @@
  */
 package org.apache.shiro.web.tags;
 
+import org.owasp.encoder.Encode;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -40,6 +41,8 @@ import java.io.IOException;
  * is not authenticated, the tag displays nothing unless a 
<tt>defaultValue</tt>
  * is specified.</p>
  *
+ * <p>The output is HTML-encoded.</p>
+ *
  * @since 0.2
  */
 public class PrincipalTag extends SecureTag {
@@ -143,7 +146,7 @@ public class PrincipalTag extends SecureTag {
         // Print out the principal value if not null
         if (strValue != null) {
             try {
-                pageContext.getOut().write(strValue);
+                pageContext.getOut().write(Encode.forHtml(strValue));
             } catch (IOException e) {
                 throw new JspTagException("Error writing [" + strValue + "] to 
JSP.", e);
             }