fix: Escape the display name. (#593)

jitsi · Sep 22, 2020 · d7c66dc · d7c66dc
1 parent a382d32
commit d7c66dc
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/main/java/org/jitsi/jicofo/auth/ShibbolethHandler.java b/src/main/java/org/jitsi/jicofo/auth/ShibbolethHandler.java
@@ -17,6 +17,7 @@
  */
 package org.jitsi.jicofo.auth;
 
+import com.google.common.html.*;
 import org.eclipse.jetty.server.*;
 import org.eclipse.jetty.server.handler.*;
 
@@ -240,7 +241,7 @@ private void doHandle(
         boolean close = "true".equalsIgnoreCase(request.getParameter("close"));
 
         responseWriter.println("<html><head><head/><body>");
-        responseWriter.println("<h1>Hello " + displayName + "!<h1/>");
+        responseWriter.println("<h1>Hello " + HtmlEscapers.htmlEscaper().escape(displayName) + "!<h1/>");
         if (!close)
         {
             responseWriter.println(