Validate callback URL

wso2 · Mar 20, 2024 · 44687e3 · 44687e3
1 parent 7415fba
commit 44687e3
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/modules/distribution/product/src/main/extensions/self-registration-username-request.jsp b/modules/distribution/product/src/main/extensions/self-registration-username-request.jsp
@@ -47,7 +47,8 @@
     Object errorMsgObj = request.getAttribute("errorMsg");
     String callback = Encode.forHtmlAttribute(request.getParameter("callback"));
     boolean isCallBackUrlEmpty = false;
-    if (request.getParameter("callback") == null || request.getParameter("callback").length() == 0) {
+    if (Encode.forHtmlAttribute(request.getParameter("callback")) == null ||
+    Encode.forHtmlAttribute(request.getParameter("callback")).length() == 0) {
         isCallBackUrlEmpty = true;
     }
     String errorCode = null;
@@ -214,7 +215,9 @@
 
                         <div class="align-right buttons">
                              <% if (!isCallBackUrlEmpty) { %>
-                            <a id="goBack" href='<%=request.getParameter("callback")%>' class="ui button link-button">
+                            <a id="goBack"
+                               href='<%=Encode.forHtmlAttribute(request.getParameter("callback"))%>'
+                               class="ui button link-button">
                             <% } else { %>
                             <a id="goBack" onclick="window.history.back()" class="ui button link-button">
                             <% } %>