From ec0554c4306ac60e49acc54c1acfb4eb06d399bb Mon Sep 17 00:00:00 2001
From: "David M. Johnson" <snoopdave@apache.org>
Date: Mon, 14 Sep 2026 19:06:58 -0400
Subject: [PATCH] Format LDAP comment form values consistently

---
 .../comments/LdapCommentAuthenticator.java    |  5 +-
 .../LdapCommentAuthenticatorTest.java         | 87 +++++++++++++++++++
 2 files changed, 90 insertions(+), 2 deletions(-)
 create mode 100644 app/src/test/java/org/apache/roller/weblogger/ui/rendering/plugins/comments/LdapCommentAuthenticatorTest.java

diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/rendering/plugins/comments/LdapCommentAuthenticator.java b/app/src/main/java/org/apache/roller/weblogger/ui/rendering/plugins/comments/LdapCommentAuthenticator.java
index 27a5e1e47..e94d6a8c6 100644
--- a/app/src/main/java/org/apache/roller/weblogger/ui/rendering/plugins/comments/LdapCommentAuthenticator.java
+++ b/app/src/main/java/org/apache/roller/weblogger/ui/rendering/plugins/comments/LdapCommentAuthenticator.java
@@ -29,6 +29,7 @@
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.apache.commons.text.StringEscapeUtils;
 import org.apache.roller.weblogger.config.WebloggerConfig;
 import org.apache.roller.weblogger.util.I18nMessages;
 import org.springframework.util.StringUtils;
@@ -84,14 +85,14 @@ public String getHtml(HttpServletRequest request) {
 		sb.append("</p>");
 		sb.append("<p>");
 		sb.append("<input name=\"ldapUser\" value=\"");
-		sb.append(ldapUser + "\">");
+		sb.append(StringEscapeUtils.escapeHtml4(ldapUser)).append("\">");
 		sb.append("</p>");
 		sb.append("<p>");
 		sb.append(messages.getString("comments.ldapAuthenticatorPassword"));
 		sb.append("</p>");
 		sb.append("<p>");
 		sb.append("<input type=\"password\" name=\"ldapPass\" value=\"");
-		sb.append(ldapPass + "\">");
+		sb.append(StringEscapeUtils.escapeHtml4(ldapPass)).append("\">");
 		sb.append("</p>");
 
 		return sb.toString();
diff --git a/app/src/test/java/org/apache/roller/weblogger/ui/rendering/plugins/comments/LdapCommentAuthenticatorTest.java b/app/src/test/java/org/apache/roller/weblogger/ui/rendering/plugins/comments/LdapCommentAuthenticatorTest.java
new file mode 100644
index 000000000..74449b058
--- /dev/null
+++ b/app/src/test/java/org/apache/roller/weblogger/ui/rendering/plugins/comments/LdapCommentAuthenticatorTest.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.roller.weblogger.ui.rendering.plugins.comments;
+
+import java.util.Locale;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+class LdapCommentAuthenticatorTest {
+
+    @Test
+    void rendersEmptyFieldsOnFirstVisit() {
+        HttpServletRequest request = mock(HttpServletRequest.class);
+        HttpSession session = mock(HttpSession.class);
+        when(request.getSession(true)).thenReturn(session);
+        String html = render(request);
+        assertFields(html, "", "");
+        verify(session).setAttribute("ldapUser", "");
+        verify(session).setAttribute("ldapPass", "");
+    }
+
+    @Test
+    void rendersMissingValuesAsEmpty() {
+        assertFields(renderReturningVisit(null, null), "", "");
+    }
+
+    @Test
+    void preservesOrdinaryFormValues() {
+        assertFields(renderReturningVisit("reader", "sample-pass"), "reader", "sample-pass");
+    }
+
+    @Test
+    void formatsPunctuationInFormValues() {
+        String value = "A&B \"quoted\" <label> 'name'";
+        String formatted = "A&amp;B &quot;quoted&quot; &lt;label&gt; 'name'";
+        assertFields(renderReturningVisit(value, value), formatted, formatted);
+    }
+
+    @Test
+    void preservesLiteralEntityText() {
+        assertFields(renderReturningVisit("&quot;", "&#34;"), "&amp;quot;", "&amp;#34;");
+    }
+
+    private String renderReturningVisit(String user, String password) {
+        HttpServletRequest request = mock(HttpServletRequest.class);
+        HttpSession session = mock(HttpSession.class);
+        when(request.getSession(true)).thenReturn(session);
+        when(session.getAttribute("ldapUser")).thenReturn("");
+        when(request.getParameter("ldapUser")).thenReturn(user);
+        when(request.getParameter("ldapPass")).thenReturn(password);
+        return render(request);
+    }
+
+    private String render(HttpServletRequest request) {
+        try (MockedStatic<CommentAuthenticatorUtils> locales = mockStatic(CommentAuthenticatorUtils.class)) {
+            locales.when(() -> CommentAuthenticatorUtils.getLocale(request)).thenReturn(Locale.ENGLISH);
+            return new LdapCommentAuthenticator().getHtml(request);
+        }
+    }
+
+    private void assertFields(String html, String user, String password) {
+        assertTrue(html.contains("<input name=\"ldapUser\" value=\"" + user + "\">"));
+        assertTrue(html.contains("<input type=\"password\" name=\"ldapPass\" value=\"" + password + "\">"));
+    }
+}