(syncope) branch master updated: Ensuring to properly escape the notification message

[ilgrosso]

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/master by this push:
     new 6f167ff2c8 Ensuring to properly escape the notification message
6f167ff2c8 is described below

commit 6f167ff2c8e6dda89d184114cfd0b23fb572a907
Author: Francesco Chicchiriccò <ilgro...@apache.org>
AuthorDate: Mon Aug 24 10:32:16 2026 +0200

    Ensuring to properly escape the notification message
---
 .../java/org/apache/syncope/client/ui/commons/pages/BaseLogin.java   | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git 
a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/pages/BaseLogin.java
 
b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/pages/BaseLogin.java
index 0097209911..15d2785ffb 100644
--- 
a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/pages/BaseLogin.java
+++ 
b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/pages/BaseLogin.java
@@ -248,7 +248,10 @@ public abstract class BaseLogin extends WebPage {
 
         if (StringUtils.isNotBlank(notificationMessage)) {
             
response.render(OnLoadHeaderItem.forScript(StyledNotificationBehavior.jQueryShow(
-                    StringEscapeUtils.escapeEcmaScript(notificationMessage),
+                    StringEscapeUtils.escapeHtml4(
+                            StringEscapeUtils.escapeHtml3(
+                                    StringEscapeUtils.escapeJson(
+                                            
StringEscapeUtils.escapeEcmaScript(notificationMessage)))),
                     
"jQuery('#%s').data('kendoNotification')".formatted(notificationPanel.getNotificationMarkupId()),
                     notificationLevel)));
         }