Encoding output text
@@ -1039,6 +1039,9 @@ jQuery('#advancedClaimMappingAddLink').click(function () {
}
advancedClaimMappinRowID++;
$("#advanced_claim_id_count").val(advancedClaimMappinRowID + 1);
+
+ // Encoding the selectedIDPClaimName to avoid possible xss vulnerabilities.
+ selectedIDPClaimName = htmlEncode(selectedIDPClaimName);
jQuery('#advancedClaimMappingAddTable').append(jQuery('<tr>' +
'<td><input type="text" style="width: 99%;" value="' + selectedIDPClaimName + '" id="advancnedIdpClaim_' + advancedClaimMappinRowID + '" name="advancnedIdpClaim_' + advancedClaimMappinRowID + '" readonly="readonly" /></td>' +
'<td><input type="text" style="width: 99%;" id="advancedDefault_' + advancedClaimMappinRowID + '" name="advancedDefault_' + advancedClaimMappinRowID + '"/></td> ' +
