diff --git a/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java b/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java index 0493e679a24..81c3ee1c7c2 100755 --- a/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java +++ b/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java @@ -381,7 +381,7 @@ public class BaseSAML2BindingBuilder { .append("") .append("") - .append("
"); + .append(""); builder.append("

Redirecting, please wait.

"); diff --git a/services/src/main/java/org/keycloak/protocol/oidc/utils/OIDCRedirectUriBuilder.java b/services/src/main/java/org/keycloak/protocol/oidc/utils/OIDCRedirectUriBuilder.java index 513cb0453aa..e09e4ba789f 100644 --- a/services/src/main/java/org/keycloak/protocol/oidc/utils/OIDCRedirectUriBuilder.java +++ b/services/src/main/java/org/keycloak/protocol/oidc/utils/OIDCRedirectUriBuilder.java @@ -160,7 +160,9 @@ public abstract class OIDCRedirectUriBuilder { builder.append(" "); builder.append(" "); - builder.append(" "); + builder.append(" "); for (Map.Entry param : params.entrySet()) { builder.append(" { + assertThat(response, statusCodeIsHC(Response.Status.OK)); + String responsePage = EntityUtils.toString(response.getEntity(), "UTF-8"); + return SamlClient.extractFormFromPostResponse(responsePage) + .attributes().asList().stream() + .filter(a -> "action".equalsIgnoreCase(a.getKey())) + .map(org.jsoup.nodes.Attribute::getValue) + .findAny().orElse(null); + }); + // if not encoded properly jsoup returns ":" instead of ":" + assertThat(action, endsWith("javascript:alert('xss');")); + } + } }