Escape reflected request parameters in the sample servlets

openam-distribution/src/main/amserver/demo/source/com/sun/identity/demo/server/EvaluatePolicyServlet.java

@@ -22,7 +22,7 @@
  * your own identifying information:
  * "Portions Copyrighted [year] [name of copyright owner]"
  *
- * Portions Copyrighted 2025 3A Systems LLC
+ * Portions Copyrighted 2025-2026 3A Systems LLC
  *
  * $Id: EvaluatePolicyServlet.java,v 1.2 2008/06/25 05:40:25 qcheng Exp $
  *
@@ -44,14 +44,15 @@
 import com.sun.identity.shared.debug.Debug;
 //import com.iplanet.am.util.Debug;
 import com.iplanet.am.util.SystemProperties;
-import com.iplanet.am.util.XMLUtils;
 import com.iplanet.sso.SSOToken;
 import com.iplanet.sso.SSOTokenManager;
 
 import com.sun.identity.shared.Constants;
 import com.sun.identity.policy.PolicyEvaluator;
 import com.sun.identity.policy.PolicyDecision;
 
+import org.apache.commons.lang3.StringEscapeUtils;
+
 public class EvaluatePolicyServlet extends HttpServlet {
 
     // the debug file
@@ -154,16 +155,19 @@ protected void processRequest(
                 PolicyDecision pd = pe.getPolicyDecision(ssoToken, resource, 
                     actions, null);
                 boolean allowed = pe.isAllowed(ssoToken, resource, "GET", null);
+                // The resource is a request parameter reflected into the page.
+                String escapedResource =
+                    StringEscapeUtils.escapeHtml4(resource);
                 StringBuffer message = new StringBuffer("<pre>");
-                message.append("isAllowed() for ").append(resource).
+                message.append("isAllowed() for ").append(escapedResource).
                 append(" action:GET is:   ");
                 message = message.append(allowed);
                 message.append(NEWLINE);
                 message.append(NEWLINE);
-                message.append("getPolicyDecision() for ").append(resource).
+                message.append("getPolicyDecision() for ").append(escapedResource).
                     append(" action:GET is:");
                 message.append(NEWLINE);
-                message.append(XMLUtils.escapeSpecialCharacters(pd.toXML()));
+                message.append(StringEscapeUtils.escapeHtml4(pd.toXML()));
                 message.append("</pre>");
                 sendResponse(response, message.toString());
             }

openam-examples/openam-example-clientsdk-war/pom.xml

@@ -13,7 +13,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2012-2016 ForgeRock AS.
- * Portions copyright 2025 3A Systems LLC.
+ * Portions copyright 2025-2026 3A Systems LLC.
 -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <modelVersion>4.0.0</modelVersion>
@@ -90,6 +90,10 @@
             <groupId>org.openidentityplatform.openam</groupId>
             <artifactId>openam-clientsdk</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+        </dependency>
         <dependency>
              <groupId>org.owasp.esapi</groupId>
              <artifactId>esapi</artifactId>

openam-examples/openam-example-clientsdk-war/src/main/java/com/sun/identity/samples/clientsdk/ServiceConfigServlet.java

@@ -25,7 +25,7 @@
  * $Id: ServiceConfigServlet.java,v 1.3 2008/06/25 05:41:09 qcheng Exp $
  *
  * Portions Copyrighted 2015-2016 ForgeRock AS.
- * Portions Copyrighted 2025 3A Systems LLC.
+ * Portions Copyrighted 2025-2026 3A Systems LLC.
  */
 
 package com.sun.identity.samples.clientsdk;
@@ -39,6 +39,7 @@
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import org.apache.commons.lang3.StringEscapeUtils;
 
 /**
  * Sample program that lists service configurations.
@@ -83,8 +84,9 @@ public void doGet(
             return;
         }
 
-        out.println("<h3>ServiceName:</h3> " + servicename);
-        out.println("<br><h3>Username:</h3> " + username);
+        // Request parameters are reflected into the page: escape them.
+        out.println("<h3>ServiceName:</h3> " + StringEscapeUtils.escapeHtml4(servicename));
+        out.println("<br><h3>Username:</h3> " + StringEscapeUtils.escapeHtml4(username));
 
         try {
             AuthContext lc = authenticate(orgname, username, password, out);

openam-examples/openam-example-clientsdk-war/src/main/java/com/sun/identity/samples/clientsdk/UserProfileServlet.java

@@ -25,7 +25,7 @@
  * $Id: UserProfileServlet.java,v 1.3 2008/06/25 05:41:09 qcheng Exp $
  *
  * Portions Copyrighted 2016 ForgeRock AS.
- * Portions Copyrighted 2025 3A Systems LLC.
+ * Portions Copyrighted 2025-2026 3A Systems LLC.
  */
 
 package com.sun.identity.samples.clientsdk;
@@ -42,6 +42,7 @@
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import org.apache.commons.lang3.StringEscapeUtils;
 
 /**
  * Sample program that show user profile.
@@ -80,7 +81,8 @@ public void doGet(
             return;
         }
 
-        out.println("<br><h3>Username:</h3> " + username);
+        // The user name is a request parameter reflected into the page: escape it.
+        out.println("<br><h3>Username:</h3> " + StringEscapeUtils.escapeHtml4(username));
 
         try {
             // Authenticate the user and obtain SSO Token