(syncope) branch 4_1_X updated: Ensuring to properly escape the notification message

[ilgrosso]

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch 4_1_X
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/4_1_X by this push:
     new b1f5f82d92 Ensuring to properly escape the notification message
b1f5f82d92 is described below

commit b1f5f82d929219d5436f4ab005bd258cada4b0f2
Author: Francesco Chicchiriccò <ilgro...@apache.org>
AuthorDate: Mon Aug 24 10:32:16 2026 +0200

    Ensuring to properly escape the notification message
---
 .../java/org/apache/syncope/client/ui/commons/pages/BaseLogin.java   | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git 
a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/pages/BaseLogin.java
 
b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/pages/BaseLogin.java
index 0097209911..15d2785ffb 100644
--- 
a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/pages/BaseLogin.java
+++ 
b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/pages/BaseLogin.java
@@ -248,7 +248,10 @@ public abstract class BaseLogin extends WebPage {
 
         if (StringUtils.isNotBlank(notificationMessage)) {
             
response.render(OnLoadHeaderItem.forScript(StyledNotificationBehavior.jQueryShow(
-                    StringEscapeUtils.escapeEcmaScript(notificationMessage),
+                    StringEscapeUtils.escapeHtml4(
+                            StringEscapeUtils.escapeHtml3(
+                                    StringEscapeUtils.escapeJson(
+                                            
StringEscapeUtils.escapeEcmaScript(notificationMessage)))),
                     
"jQuery('#%s').data('kendoNotification')".formatted(notificationPanel.getNotificationMarkupId()),
                     notificationLevel)));
         }