Merge pull request #7367 from KD23243/removejsfromcallback

wso2 · Jan 23, 2025 · a99d84e · a99d84e
2 parents c629a68 + 85c90ff
commit a99d84e
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 4 deletions.
diff --git a/.changeset/curly-bags-relate.md b/.changeset/curly-bags-relate.md
@@ -0,0 +1,5 @@
+---
+"@wso2is/identity-apps-core": patch
+---
+
+Add sanitation to self registration callback
diff --git a/...ity-apps-core/apps/recovery-portal/src/main/webapp/self-registration-username-request.jsp b/...ity-apps-core/apps/recovery-portal/src/main/webapp/self-registration-username-request.jsp
@@ -737,13 +737,18 @@
 
                         <div class="ui divider hidden"></div>
                         <%
-                            if (!StringUtils.equalsIgnoreCase(backToUrl,"null") && !StringUtils.isBlank(backToUrl)) {
+                            if (!StringUtils.equalsIgnoreCase(backToUrl, "null") &&
+                                !StringUtils.isBlank(backToUrl) &&
+                                !backToUrl.toLowerCase().contains("javascript:") &&
+                                !backToUrl.toLowerCase().contains("file:") &&
+                                !backToUrl.toLowerCase().contains("ftp:") &&
+                                !backToUrl.toLowerCase().contains("data:")) {
                         %>
                         <div class="buttons mt-2">
                             <div class="field external-link-container text-small">
                                 <%=IdentityManagementEndpointUtil.i18n(recoveryResourceBundle,
                                         "Already.have.an.account")%>
-                                <a href="<%= StringEscapeUtils.escapeHtml4(backToUrl) %>">
+                                <a href="<%=backToUrl%>">
                                     <%=IdentityManagementEndpointUtil.i18n(recoveryResourceBundle, "Sign.in")%>
                                 </a>
                             </div>
@@ -1296,13 +1301,18 @@
                         </div>
                         <div class="ui divider hidden"></div>
                         <%
-                            if (!StringUtils.equalsIgnoreCase(backToUrl,"null") && !StringUtils.isBlank(backToUrl)) {
+                            if (!StringUtils.equalsIgnoreCase(backToUrl, "null") &&
+                                !StringUtils.isBlank(backToUrl) &&
+                                !backToUrl.toLowerCase().contains("javascript:") &&
+                                !backToUrl.toLowerCase().contains("file:") &&
+                                !backToUrl.toLowerCase().contains("ftp:") &&
+                                !backToUrl.toLowerCase().contains("data:")) {
                         %>
                         <div class="buttons mt-2">
                             <div class="field external-link-container text-small">
                                 <%=IdentityManagementEndpointUtil.i18n(recoveryResourceBundle,
                                         "Already.have.an.account")%>
-                                <a href="<%= StringEscapeUtils.escapeHtml4(backToUrl) %>">
+                                <a href="<%=backToUrl%>">
                                     <%=IdentityManagementEndpointUtil.i18n(recoveryResourceBundle, "Sign.in")%>
                                 </a>
                             </div>