link
", html); + html.set(0, ""); + assertResult("link
", html); + + html.set(0, ""); + assertResult("link
", html); + + // Effectively same as previous case, but with \0 character added + html.set(0, ""); + assertResult("link
", html); + + html.set(0, ""); + assertResult("link
", html); + + html.set(0, ""); + assertResult("", html); + html.set(0, ""); assertResult("", html); diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/InstalledAppRedirectPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/InstalledAppRedirectPage.java new file mode 100644 index 0000000000..12d101f244 --- /dev/null +++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/InstalledAppRedirectPage.java @@ -0,0 +1,107 @@ +/* + * Copyright 2022 Red Hat, Inc. and/or its affiliates + * and other contributors as indicated by the @author tags. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ + +package org.keycloak.testsuite.pages; + +import java.net.URI; +import java.net.URISyntaxException; + +import org.junit.Assert; +import org.keycloak.OAuth2Constants; +import org.keycloak.common.util.KeycloakUriBuilder; +import org.keycloak.services.Urls; +import org.openqa.selenium.By; +import org.openqa.selenium.NoSuchElementException; +import org.openqa.selenium.WebElement; +import org.openqa.selenium.support.FindBy; + +/** + * Page represented by code.ftl. It is used by "Installed applications" (KeycloakInstalled) + * + * @author Marek Posolda + */ +public class InstalledAppRedirectPage extends AbstractPage { + + @FindBy(id = "code") + private WebElement code; + + @FindBy(id = "kc-page-title") + private WebElement pageTitle; + + @FindBy(className = "alert-error") + private WebElement errorBox; + + @Override + public void open() { + throw new UnsupportedOperationException("Use method: open(code, error, errorDescription)"); + } + + + public void open(String realmName, String code, String error, String errorDescription) { + try { + KeycloakUriBuilder kcUriBuilder = KeycloakUriBuilder.fromUri(Urls.realmInstalledAppUrnCallback(new URI(oauth.AUTH_SERVER_ROOT), realmName)); + if (code != null) { + kcUriBuilder.queryParam(OAuth2Constants.CODE, code); + } + if (error != null) { + kcUriBuilder.queryParam(OAuth2Constants.ERROR, error); + } + if (errorDescription != null) { + kcUriBuilder.queryParam(OAuth2Constants.ERROR_DESCRIPTION, errorDescription); + } + String oobEndpointUri = kcUriBuilder.build().toString(); + driver.navigate().to(oobEndpointUri); + } catch (URISyntaxException use) { + throw new IllegalArgumentException(use); + } + } + + @Override + public boolean isCurrent() { + throw new UnsupportedOperationException("Use method 'isCurrentExpectSuccess' or 'isCurrentExpectError'"); + } + + + public String getSuccessCode() { + Assert.assertEquals("Success code", getPageTitleText()); + return code.getAttribute("value"); + } + + public String getPageTitleText() { + return pageTitle.getText(); + } + + // Check if link is present inside title or error box + public void assertLinkBackToApplicationNotPresent() { + try { + pageTitle.findElement(By.tagName("a")); + throw new AssertionError("Link was present inside title"); + } catch (NoSuchElementException nsee) { + // Ignore + } + + try { + errorBox.findElement(By.tagName("a")); + throw new AssertionError("Link was present inside error box"); + } catch (NoSuchElementException nsee) { + // Ignore + } + + } +} diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/error/EscapeErrorPageTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/error/EscapeErrorPageTest.java index cf8b257859..06b7a1bee0 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/error/EscapeErrorPageTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/error/EscapeErrorPageTest.java @@ -56,12 +56,12 @@ public class EscapeErrorPageTest extends AbstractKeycloakTest { @Test public void ampersandEscape() { - checkMessage("<img src="something">", "Back to application
", installedAppPage.getPageTitleText()); + + error = ""; + installedAppPage.open("test", null, error, null); + + // In this case, link is not sanitized as it is valid link, however it is escaped and not shown as a link + installedAppPage.assertLinkBackToApplicationNotPresent(); + Assert.assertEquals("Error code: ", installedAppPage.getPageTitleText()); + } + @Test public void authorizationValidRedirectUri() throws IOException { ClientManager.realm(adminClient.realm("test")).clientId("test-app").addRedirectUris(oauth.getRedirectUri()); diff --git a/themes/src/main/resources/theme/base/login/code.ftl b/themes/src/main/resources/theme/base/login/code.ftl index 6830fc497b..bb0621db93 100755 --- a/themes/src/main/resources/theme/base/login/code.ftl +++ b/themes/src/main/resources/theme/base/login/code.ftl @@ -4,7 +4,7 @@ <#if code.success> ${msg("codeSuccessTitle")} <#else> - ${msg("codeErrorTitle", code.error)} + ${kcSanitize(msg("codeErrorTitle", code.error))} <#elseif section = "form">${msg("copyCodeInstruction")}
<#else> -${code.error}
+${kcSanitize(code.error)}