Patched src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java

Author: patched.codes[bot]

src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java

@@ -25,6 +25,7 @@
 import javax.servlet.http.HttpServletResponse;
 
 import com.ibm.security.appscan.altoromutual.util.DBUtil;
+import org.apache.commons.text.StringEscapeUtils;
 
 /**
  * This servlet handles site admin operations
@@ -115,7 +116,8 @@ else if (request.getRequestURL().toString().endsWith("changePassword")){
 		else
 			message = "Requested operation has completed successfully.";
 
-		request.getSession().setAttribute("message", message);
+		String safeMessage = StringEscapeUtils.escapeHtml4(message);
+		request.getSession().setAttribute("message", safeMessage);
 		response.sendRedirect("admin.jsp");
 		return ;
 	}