Cross-Site Scripting: Reflected

[QiAnXinCodeSafe]

azure-maven-plugins/azure-auth-helper/src/main/java/com/microsoft/azure/auth/LocalAuthServer.java

Lines 57 to 67 in 4d8e73c

	code = request.getParameter(Constants.CODE);
	// handle the error response described at
	// https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code#error-response
	errorDescription = request.getParameter(Constants.ERROR_DESCRIPTION);
	error = request.getParameter(Constants.ERROR);
	final boolean isSuccess = StringUtils.isEmpty(error) && StringUtils.isNotEmpty(code);
	response.setStatus(HttpServletResponse.SC_OK);
	response.setContentType(Constants.CONTENT_TYPE_TEXT_HTML);
	try (final PrintWriter writer = response.getWriter()) {
	writer.write(isSuccess ? loginSuccessHTMLTemplate : String.format(loginErrorHTMLTemplate, error, errorDescription));

Sending unvalidated data to a web browser can result in the browser executing malicious code.

[wangmingliang-ms]

the error and errorDescription come from Azure's own OAuth server, which should be trustable.