AjaxButton: Fixed potential XSS - do not ignore escapeModelStrings flags

Signed-off-by: Tony Tkáčik <tonydamage@gmail.com>
Evolveum · Sep 21, 2023 · e17a0e5 · e17a0e5
1 parent 123f66d
commit e17a0e5
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/AjaxButton.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/AjaxButton.java
@@ -14,6 +14,7 @@
 import org.apache.wicket.markup.MarkupStream;
 import org.apache.wicket.markup.parser.XmlTag;
 import org.apache.wicket.model.IModel;
+import org.apache.wicket.util.string.Strings;
 
 /**
  * @author lazyman
@@ -32,6 +33,10 @@ public AjaxButton(String id, IModel<String> model) {
     public void onComponentTagBody(final MarkupStream markupStream, final ComponentTag openTag) {
         String text = getModelObject();
         if (StringUtils.isNotEmpty(text)) {
+            if (this.getEscapeModelStrings()) {
+                // Escape text iif escapeModel is enabled.
+                text = Strings.escapeMarkup(text, false, false).toString();
+            }
             replaceComponentTagBody(markupStream, openTag, text);
             return;
         }