From 7e6864ff38e04fd5e0afbf719f6799fd8a11372e Mon Sep 17 00:00:00 2001
From: Justin Richer <jricher@mit.edu>
Date: Wed, 10 May 2017 17:39:48 -0400
Subject: [PATCH] escaped output values on approval page, closes #1111

---
 .../src/main/webapp/WEB-INF/views/approve.jsp                 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/views/approve.jsp b/openid-connect-server-webapp/src/main/webapp/WEB-INF/views/approve.jsp
index e9bdf36d1..4d3dda8ce 100644
--- a/openid-connect-server-webapp/src/main/webapp/WEB-INF/views/approve.jsp
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/views/approve.jsp
@@ -148,11 +148,11 @@
 										<i class="icon-info-sign"></i> <spring:message code="approve.warning"/>:
 									</h4>
 									<spring:message code="approve.no_redirect_uri"/>
-									<spring:message code="approve.redirect_uri" arguments="${redirect_uri}"/>
+									<spring:message code="approve.redirect_uri" arguments="${ fn:escapeXml(redirect_uri) }"/>
 								</div>
 							</c:when>
 							<c:otherwise>
-                                <spring:message code="approve.redirect_uri" arguments="${redirect_uri}" />
+                                <spring:message code="approve.redirect_uri" arguments="${ fn:escapeXml(redirect_uri) }" />
 							</c:otherwise>
 						</c:choose>
 					</div>