(sling-org-apache-sling-commons-crypto) branch master updated: SLING-13343 Escape dynamic values in Web Console plugin

[kwin]

This is an automated email from the ASF dual-hosted git repository.

kwin pushed a commit to branch master
in repository 
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-commons-crypto.git


The following commit(s) were added to refs/heads/master by this push:
     new ad524f1  SLING-13343 Escape dynamic values in Web Console plugin
ad524f1 is described below

commit ad524f163f0df24edc0c5c797a6ca783cd435984
Author: Konrad Windszus <k...@apache.org>
AuthorDate: Sun Sep 13 12:56:05 2026 +0200

    SLING-13343 Escape dynamic values in Web Console plugin
---
 .../commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git 
a/src/main/java/org/apache/sling/commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java
 
b/src/main/java/org/apache/sling/commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java
index e2587b8..daf8c2f 100644
--- 
a/src/main/java/org/apache/sling/commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java
+++ 
b/src/main/java/org/apache/sling/commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java
@@ -98,7 +98,7 @@ public final class EncryptWebConsolePlugin extends 
HttpServlet {
         if (Objects.nonNull(forwardRequestUri) && 
forwardRequestUri.equals(request.getRequestURI())) {
             final String ciphertext = (String) 
request.getAttribute(ATTRIBUTE_CIPHERTEXT);
             if (Objects.nonNull(ciphertext)) {
-                final String html = String.format("<p 
id=\"ciphertext\">Encrypted message: %s</p>", ciphertext);
+                final String html = String.format("<p 
id=\"ciphertext\">Encrypted message: %s</p>", 
JcaProviderAlgorithmsWebConsolePlugin.escapeHtml(ciphertext));
                 writer.println(html);
             }
         }
@@ -159,8 +159,8 @@ public final class EncryptWebConsolePlugin extends 
HttpServlet {
             CryptoService service = findCryptoService(id);
             final String algorithm = 
Objects.toString(service.getAlgorithmDescription(), "");
             final String label = String.format("Service id %s (%s), names: %s, 
algorithm(s): %s", id, description, Arrays.toString(names), algorithm);
-            builder.append("<option value=\"").append(id).append("\">");
-            builder.append(label);
+            builder.append("<option 
value=\"").append(JcaProviderAlgorithmsWebConsolePlugin.escapeHtml(id)).append("\">");
+            
builder.append(JcaProviderAlgorithmsWebConsolePlugin.escapeHtml(label));
             builder.append("</option>");
         }
         builder.append("</label>");