From fa44c74993809eec88104082e011fa4d7c3b3cfa Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Mon, 5 May 2008 18:37:02 +0000 Subject: [PATCH] SEC-812: Added entity-escaping of username stored under last username key, to prevent problems if it is rendered in a page without escaping the text. --- .../security/ui/webapp/AuthenticationProcessingFilter.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/org/springframework/security/ui/webapp/AuthenticationProcessingFilter.java b/core/src/main/java/org/springframework/security/ui/webapp/AuthenticationProcessingFilter.java index fb49f9e15e..eaf15f9c55 100644 --- a/core/src/main/java/org/springframework/security/ui/webapp/AuthenticationProcessingFilter.java +++ b/core/src/main/java/org/springframework/security/ui/webapp/AuthenticationProcessingFilter.java @@ -22,6 +22,7 @@ import org.springframework.security.providers.UsernamePasswordAuthenticationToke import org.springframework.security.ui.AbstractProcessingFilter; import org.springframework.security.ui.FilterChainOrder; +import org.springframework.security.util.TextUtils; import org.springframework.util.Assert; import javax.servlet.http.HttpServletRequest; @@ -72,7 +73,7 @@ public class AuthenticationProcessingFilter extends AbstractProcessingFilter { HttpSession session = request.getSession(false); if (session != null || getAllowSessionCreation()) { - request.getSession().setAttribute(SPRING_SECURITY_LAST_USERNAME_KEY, username); + request.getSession().setAttribute(SPRING_SECURITY_LAST_USERNAME_KEY, TextUtils.escapeEntities(username)); } // Allow subclasses to set the "details" property