Source:
<code>private void sendData(HttpServletResponse httpResp, ResponseToken respToken, String action, String authenticatedIdPs) throws ServletException, IOException { if (stsRedirectPage == null || stsRedirectPage.trim().length() == 0) { stsRedirectPage = readPassiveSTSHtmlRedirectPage(); } String finalPage = null; String htmlPage = stsRedirectPage; String pageWithReply = htmlPage.replace("$url", String.valueOf(respToken.getReplyTo())); String pageWithReplyAction = pageWithReply.replace("$action", String.valueOf(action)); String pageWithReplyActionResult = pageWithReplyAction.replace("$result", StringEscapeUtils.escapeHtml(String.valueOf(respToken.getResults()))); String pageWithReplyActionResultContext; if(respToken.getContext() !=null) { pageWithReplyActionResultContext = pageWithReplyActionResult.replace( "<!--$additionalParams-->", "<!--$additionalParams-->" + "<input type='hidden' name='wctx' value='" +respToken.getContext() + "'>"); } else { pageWithReplyActionResultContext = pageWithReplyActionResult; } if (authenticatedIdPs == null || authenticatedIdPs.isEmpty()) { finalPage = pageWithReplyActionResultContext; } else { finalPage = pageWithReplyActionResultContext.replace("<!--$additionalParams-->", "<input type='hidden' name='AuthenticatedIdPs' value='" + Encode.forHtmlAttribute(authenticatedIdPs) + "'>"); } PrintWriter out = httpResp.getWriter(); <START> out.print(Encode.forHtml(finalPage)); <END> if (log.isDebugEnabled()) { log.debug("sts_response.html : " + finalPage); } return; }</code><technical_language>wrong encode full page here. Instead encode replacement for $url (line 182). I $action $result in html page template IS_HOME/repository/resources/identity/pages/sts_response.html. Check if needed remove if longer used. encode line 189</technical_language>

Target:
private void sendData(HttpServletResponse httpResp, ResponseToken respToken, String action, String authenticatedIdPs) throws ServletException, IOException { if (stsRedirectPage == null || stsRedirectPage.trim().length() == 0) { stsRedirectPage = readPassiveSTSHtmlRedirectPage(); } String finalPage = null; String htmlPage = stsRedirectPage; String pageWithReply = htmlPage.replace("$url", String.valueOf(respToken.getReplyTo())); String pageWithReplyAction = pageWithReply.replace("$action", Encode.forHtml(String.valueOf(action))); String pageWithReplyActionResult = pageWithReplyAction.replace("$result", Encode.forHtml(String.valueOf(respToken.getResults()))); String pageWithReplyActionResultContext; if(respToken.getContext() !=null) { pageWithReplyActionResultContext = pageWithReplyActionResult.replace( "<!--$additionalParams-->", "<!--$additionalParams-->" + "<input type='hidden' name='wctx' value='" + Encode.forHtmlAttribute(respToken.getContext())+ "'>"); } else { pageWithReplyActionResultContext = pageWithReplyActionResult; } if (authenticatedIdPs == null || authenticatedIdPs.isEmpty()) { finalPage = pageWithReplyActionResultContext; } else { finalPage = pageWithReplyActionResultContext.replace("<!--$additionalParams-->", "<input type='hidden' name='AuthenticatedIdPs' value='" + Encode.forHtmlAttribute(authenticatedIdPs) + "'>"); } PrintWriter out = httpResp.getWriter(); out.print(finalPage); if (log.isDebugEnabled()) { log.debug("sts_response.html : " + finalPage); } return; }