(syncope) branch 4_0_X updated: Ensuring to properly escape the notification message

[ilgrosso]

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch 4_0_X
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/4_0_X by this push:
     new 967ef736c3 Ensuring to properly escape the notification message
967ef736c3 is described below

commit 967ef736c34a54a02a14448df24fec43e4e20b24
Author: Francesco Chicchiriccò <ilgro...@apache.org>
AuthorDate: Mon Aug 24 10:32:16 2026 +0200

    Ensuring to properly escape the notification message
---
 .../main/java/org/apache/syncope/client/ui/commons/BaseLogin.java    | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git 
a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java
 
b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java
index 8b78101b03..45641e4a81 100644
--- 
a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java
+++ 
b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java
@@ -199,7 +199,10 @@ public abstract class BaseLogin extends WebPage {
 
         if (StringUtils.isNotBlank(notificationMessage)) {
             
response.render(OnLoadHeaderItem.forScript(StyledNotificationBehavior.jQueryShow(
-                    StringEscapeUtils.escapeEcmaScript(notificationMessage),
+                    StringEscapeUtils.escapeHtml4(
+                            StringEscapeUtils.escapeHtml3(
+                                    StringEscapeUtils.escapeJson(
+                                            
StringEscapeUtils.escapeEcmaScript(notificationMessage)))),
                     
"jQuery('#%s').data('kendoNotification')".formatted(notificationPanel.getNotificationMarkupId()),
                     notificationLevel)));
         }