From 304033445a8333cd088910fc3e43ca9222237816 Mon Sep 17 00:00:00 2001 From: robertlo Date: Mon, 8 Jan 2018 17:08:00 -0500 Subject: Harden code Issue-ID: PORTAL-145 Harden code to address Open Redirect in Portal SDK Change-Id: If7e923366be11b78c1359dfe5b8fc14a2927c668 Signed-off-by: robertlo --- .../src/main/java/org/onap/portalsdk/core/onboarding/util/SSOUtil.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util') diff --git a/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/SSOUtil.java b/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/SSOUtil.java index 2d491cfa..c1776959 100644 --- a/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/SSOUtil.java +++ b/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/SSOUtil.java @@ -45,6 +45,7 @@ import javax.servlet.http.HttpServletResponse; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; +import org.owasp.esapi.ESAPI; public class SSOUtil { @@ -69,7 +70,7 @@ public class SSOUtil { try { encodedAppURL = URLEncoder.encode(appURL, "UTF-8"); } catch (UnsupportedEncodingException ex) { - logger.error("getECOMPSSORedirectURL: Failed to encode app URL " + appURL, ex); + logger.error("getECOMPSSORedirectURL: Failed to encode app URL " + ESAPI.encoder().encodeForHTML(appURL), ex); } String portalURL = PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REDIRECT_URL); if (portalURL == null || portalURL.length() == 0) { -- cgit 1.2.3-korg