Add Improvements#14206
Open
e19166 wants to merge 1 commit into
Open
Conversation
e19166
requested review from
AnuGayan,
Arshardh,
chamilaadhi and
tharindu1st
as code owners
Contributor
📝 WalkthroughWalkthroughThis PR changes four JSP locations across two distributions to apply context-appropriate escaping: the resend-confirmation link now uses cleaned query strings that are HTML-attribute-encoded, and invite/password-reset-complete pages now HTML-escape displayed usernames. ChangesOutput Encoding Fixes
🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
api-control-plane/modules/distribution/product/src/main/extensions/basicauth.jsp (1)
560-562: ⚡ Quick winSimplify the resend link by precomputing the href outside the attribute.
The nested JSP expressions with mixed encoding (
forHtml+forHtmlAttribute) within the href attribute is fragile and harder to maintain. Build the URL in a local variable and applyforHtmlAttributeonce at the sink instead.+ String resendConfirmationHref = "login.do?resend_username=" + + URLEncoder.encode(request.getParameter("failedUsername"), UTF_8) + + "&" + + AuthenticationEndpointUtil.cleanErrorMessages(request.getQueryString()); ... - href="login.do?resend_username=<%=Encode.forHtml(URLEncoder.encode(request.getParameter("failedUsername"), UTF_8))%>&<%=Encode.forHtmlAttribute(AuthenticationEndpointUtil.cleanErrorMessages(request.getQueryString()))%>" + href="<%=Encode.forHtmlAttribute(resendConfirmationHref)%>"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api-control-plane/modules/distribution/product/src/main/extensions/basicauth.jsp` around lines 560 - 562, Precompute the resend URL into a local JSP variable instead of nesting expressions inside the href on the element with id "registerLink": build a String (e.g., resendUrl) by URL-encoding request.getParameter("failedUsername") with URLEncoder.encode(..., UTF_8), append the cleaned query string from AuthenticationEndpointUtil.cleanErrorMessages(request.getQueryString()), then apply Encode.forHtmlAttribute once when emitting the href (e.g., href="<%=Encode.forHtmlAttribute(resendUrl)%>"). Update the anchor with data-testid="login-page-resend-confirmation-email-link" to reference that variable.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@all-in-one-apim/modules/distribution/product/src/main/extensions/basicauth.jsp`:
- Around line 560-562: The href attribute on the anchor with id "registerLink"
mixes Encode.forHtml and Encode.forHtmlAttribute; instead precompute the full
URL string in a scriptlet/local variable (use
URLEncoder.encode(request.getParameter("failedUsername"), UTF_8) and
AuthenticationEndpointUtil.cleanErrorMessages(request.getQueryString()) to build
the query), then apply Encode.forHtmlAttribute(...) once to the entire href when
rendering the attribute; update the reference to use that variable and remove
the mixed encodings so the entire attribute value is consistently encoded.
---
Nitpick comments:
In
`@api-control-plane/modules/distribution/product/src/main/extensions/basicauth.jsp`:
- Around line 560-562: Precompute the resend URL into a local JSP variable
instead of nesting expressions inside the href on the element with id
"registerLink": build a String (e.g., resendUrl) by URL-encoding
request.getParameter("failedUsername") with URLEncoder.encode(..., UTF_8),
append the cleaned query string from
AuthenticationEndpointUtil.cleanErrorMessages(request.getQueryString()), then
apply Encode.forHtmlAttribute once when emitting the href (e.g.,
href="<%=Encode.forHtmlAttribute(resendUrl)%>"). Update the anchor with
data-testid="login-page-resend-confirmation-email-link" to reference that
variable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9ac4ebb6-7d62-4b36-a29b-8a961960b682
📒 Files selected for processing (4)
all-in-one-apim/modules/distribution/product/src/main/extensions/basicauth.jspall-in-one-apim/modules/distribution/product/src/main/extensions/password-reset-complete.jspapi-control-plane/modules/distribution/product/src/main/extensions/basicauth.jspapi-control-plane/modules/distribution/product/src/main/extensions/password-reset-complete.jsp
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@api-control-plane/modules/distribution/product/src/main/extensions/basicauth.jsp`:
- Around line 560-562: Precompute the full resend URL into a local String (e.g.,
String resendUrl) by building the query string using
URLEncoder.encode(request.getParameter("failedUsername"), UTF_8) and
AuthenticationEndpointUtil.cleanErrorMessages(request.getQueryString()), then
call Encode.forHtmlAttribute(resendUrl) once when rendering the href for the
anchor with id "registerLink" instead of interleaving
Encode.forHtml/Encode.forHtmlAttribute around fragments; this removes
fragment-level encoding and satisfies PMD.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: a7f00304-5337-4a7b-bba3-eddfd21c4f20
📒 Files selected for processing (4)
all-in-one-apim/modules/distribution/product/src/main/extensions/basicauth.jspall-in-one-apim/modules/distribution/product/src/main/extensions/password-reset-complete.jspapi-control-plane/modules/distribution/product/src/main/extensions/basicauth.jspapi-control-plane/modules/distribution/product/src/main/extensions/password-reset-complete.jsp
🚧 Files skipped from review as they are similar to previous changes (1)
- all-in-one-apim/modules/distribution/product/src/main/extensions/password-reset-complete.jsp
hisanhunais
approved these changes
May 19, 2026
hisanhunais
approved these changes
Jun 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add Improvements