SEC-1420: Add htmlEscape attribute to authentication JSP tag.

This allows HTML escaping to be disabled if required.

taglibs/src/main/java/org/springframework/security/taglibs/authz/AuthenticationTag.java

@@ -23,6 +23,7 @@ import org.springframework.security.web.util.TextEscapeUtils;
 
 import org.springframework.beans.BeanWrapperImpl;
 import org.springframework.beans.BeansException;
+import org.springframework.web.util.ExpressionEvaluationUtils;
 import org.springframework.web.util.TagUtils;
 
 import java.io.IOException;
@@ -48,6 +49,7 @@ public class AuthenticationTag extends TagSupport {
     private String property;
     private int scope;
     private boolean scopeSpecified;
+    private boolean htmlEscape = true;
 
 
     //~ Methods ========================================================================================================
@@ -120,7 +122,11 @@ public class AuthenticationTag extends TagSupport {
                 }
             }
         } else {
-            writeMessage(TextEscapeUtils.escapeEntities(String.valueOf(result)));
+            if (htmlEscape) {
+                writeMessage(TextEscapeUtils.escapeEntities(String.valueOf(result)));
+            } else {
+                writeMessage(String.valueOf(result));
+            }
         }
         return EVAL_PAGE;
     }
@@ -132,4 +138,21 @@ public class AuthenticationTag extends TagSupport {
             throw new JspException(ioe);
         }
     }
+
+
+    /**
+     * Set HTML escaping for this tag, as boolean value.
+     */
+    public void setHtmlEscape(String htmlEscape) throws JspException {
+        this.htmlEscape = ExpressionEvaluationUtils.evaluateBoolean("htmlEscape", htmlEscape, pageContext);
+    }
+
+    /**
+     * Return the HTML escaping setting for this tag,
+     * or the default setting if not overridden.
+     * @see #isDefaultHtmlEscape()
+     */
+    protected boolean isHtmlEscape() {
+        return htmlEscape;
+    }
 }

taglibs/src/main/resources/META-INF/security.tld

@@ -110,6 +110,12 @@
                 evaluated property of the Authentication object.
             </description>
         </attribute>
+        <attribute>
+            <description>Set HTML escaping for this tag, as a boolean value.</description>
+            <name>htmlEscape</name>
+            <required>false</required>
+            <rtexprvalue>true</rtexprvalue>
+        </attribute>
         <attribute>
             <name>scope</name>
             <required>false</required>