Jasig/cas — pull request #199 by mmoayyed (2013-02-06 07:36:18+00:00)
Title: CAS-1251: Possible Cross-Site Scripting on /login using execution parameter

Follow-up work on the previous commit around CAS-1251, that was posted at https://github.com/Jasig/cas/pull/190 and https://github.com/Jasig/cas/pull/191, this commit generalizes `NoSuchFlowExecutionExceptionResolver` to handle `FlowExecutionRepositoryExceptio`n is a common ancestor to webflow exceptions. Hiding these exceptions, such as `BadlyFormattedFlowExecutionKeyException`, would allow us to present the error page to the user as opposed to having the error rendered directly on the page which may include JS code passed to the /login CAS URI.

The HTML-escaped handler is now removed, since it was originally intended for the webapp and not the management webapp.

This is a summary of the work done by Scott and implements a solution suggested by Marvin.