From 0f828416d9545519e26d0694831c66af7172495e Mon Sep 17 00:00:00 2001 From: alexcasent Date: Thu, 25 Jun 2026 16:40:42 +0200 Subject: [PATCH 1/2] ESB-1144 FIX XSS in ContentManager --- .../services/content/ContentManager.java | 2 + .../content/helper/ContentActionHelper.java | 4 +- .../entando/ent/util/LabelSanitizer.java | 53 +++++++++++++++++++ 3 files changed, 58 insertions(+), 1 deletion(-) create mode 100644 engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/content/ContentManager.java b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/content/ContentManager.java index 1ec8ee3738..b8454945aa 100644 --- a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/content/ContentManager.java +++ b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/content/ContentManager.java @@ -45,6 +45,7 @@ import org.entando.entando.ent.exception.EntRuntimeException; import org.entando.entando.ent.util.EntLogging.EntLogFactory; import org.entando.entando.ent.util.EntLogging.EntLogger; +import org.entando.entando.ent.util.LabelSanitizer; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.cache.annotation.CacheEvict; @@ -293,6 +294,7 @@ public String addContent(Content content) throws EntException { private String addUpdateContent(Content content, boolean updateDate) throws EntException { String id = null; try { + content.setDescription(LabelSanitizer.stripMarkup(content.getDescription())); content.setLastModified(new Date()); if (updateDate) { content.incrementVersion(false); diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/content/helper/ContentActionHelper.java b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/content/helper/ContentActionHelper.java index f86eed98c6..5f22841753 100644 --- a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/content/helper/ContentActionHelper.java +++ b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/content/helper/ContentActionHelper.java @@ -23,6 +23,7 @@ import org.apache.commons.lang3.StringUtils; import org.apache.struts2.ServletActionContext; import org.entando.entando.aps.system.services.actionlog.model.ActivityStreamInfo; +import org.entando.entando.ent.util.LabelSanitizer; import org.entando.entando.plugins.jacms.aps.system.services.content.helper.IContentHelper; import org.entando.entando.plugins.jacms.aps.util.CmsPageUtil; import org.entando.entando.ent.util.EntLogging.EntLogger; @@ -134,7 +135,8 @@ public void scanEntity(IApsEntity entity, ActionSupport action) { String[] args = {String.valueOf(maxLength)}; action.addFieldError(DESCR, action.getText("error.content.descr.wrongMaxLength", args)); } - if (!descr.matches("([^\"])+")) { + if (!descr.matches("[^\"<>]+")) { + content.setDescription(LabelSanitizer.stripMarkup(content.getDescription())); action.addFieldError(DESCR, action.getText("error.content.descr.wrongCharacters")); } } diff --git a/engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java b/engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java new file mode 100644 index 0000000000..1adb08e9c8 --- /dev/null +++ b/engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java @@ -0,0 +1,53 @@ +/* + * Copyright 2015-Present Entando Inc. (http://www.entando.com) All rights reserved. + * + * This library is free software; you can redistribute it and/or modify it under + * the terms of the GNU Lesser General Public License as published by the Free + * Software Foundation; either version 2.1 of the License, or (at your option) + * any later version. + * + * This library is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more + * details. + */ +package org.entando.entando.ent.util; + +import java.util.ArrayList; +import com.agiletec.aps.util.ApsProperties; + +/** + * Neutralizes stored XSS in short free-text label fields (titles, names, + * descriptions) by removing the characters that allow HTML element injection. + */ +public final class LabelSanitizer { + + private LabelSanitizer() { + } + + /** + * The single quote is intentionally preserved, being legitimate and common in + * titles/descriptions; all known attribute sinks for these fields are double-quoted. + * Null-safe and idempotent. + */ + public static String stripMarkup(String value) { + return (value == null) ? null + : value.replace("<", "").replace(">", "").replace("\"", ""); + } + + /** + * Applies {@link #stripMarkup(String)} to every String value of the given properties + * in place (e.g. the per-language titles/names maps). + */ + public static void stripMarkup(ApsProperties properties) { + if (null == properties) { + return; + } + for (Object key : new ArrayList<>(properties.keySet())) { + Object value = properties.get(key); + if (value instanceof String) { + properties.put(key, stripMarkup((String) value)); + } + } + } +} \ No newline at end of file From 2f4342ee664ce8aec0a0a6930a9b92da7001c812 Mon Sep 17 00:00:00 2001 From: ffalqui Date: Thu, 25 Jun 2026 17:54:18 +0200 Subject: [PATCH 2/2] ESB-1144 FIX XSS: Sanitize user input by stripping potentially unsafe markup from labels, descriptions, and titles across various services. --- .../contentmodel/ContentModelManager.java | 4 ++++ .../services/resource/ResourceManager.java | 7 +++++-- .../common/entity/ApsEntityManager.java | 19 +++++++++++++++++++ .../services/category/CategoryManager.java | 4 ++++ .../system/services/group/GroupManager.java | 3 +++ .../aps/system/services/page/PageManager.java | 3 +++ .../services/pagemodel/PageModelManager.java | 5 +++++ .../aps/system/services/role/RoleManager.java | 3 +++ .../guifragment/GuiFragmentManager.java | 3 +++ .../widgettype/WidgetTypeManager.java | 3 +++ .../entando/ent/util/LabelSanitizer.java | 4 ++-- 11 files changed, 54 insertions(+), 4 deletions(-) diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/contentmodel/ContentModelManager.java b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/contentmodel/ContentModelManager.java index 91dddcda8b..a91ed57f0c 100644 --- a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/contentmodel/ContentModelManager.java +++ b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/contentmodel/ContentModelManager.java @@ -33,6 +33,8 @@ import java.util.List; import java.util.Map; import java.util.Properties; + +import org.entando.entando.ent.util.LabelSanitizer; import org.entando.entando.plugins.jacms.aps.system.services.content.widget.RowContentListHelper; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; @@ -113,6 +115,7 @@ public void releaseTenantAware() { */ @Override public void addContentModel(ContentModel model) throws EntException { + model.setDescription(LabelSanitizer.stripMarkup(model.getDescription())); try { this.getContentModelDAO().addContentModel(model); this.getCacheWrapper().addContentModel(model); @@ -149,6 +152,7 @@ public void removeContentModel(ContentModel model) throws EntException { */ @Override public void updateContentModel(ContentModel model) throws EntException { + model.setDescription(LabelSanitizer.stripMarkup(model.getDescription())); try { this.getContentModelDAO().updateContentModel(model); this.getCacheWrapper().updateContentModel(model); diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/ResourceManager.java b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/ResourceManager.java index 4b0d5ee5ad..7184c476a7 100644 --- a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/ResourceManager.java +++ b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/ResourceManager.java @@ -40,6 +40,7 @@ import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; import org.entando.entando.ent.util.EntSafeXmlUtils; +import org.entando.entando.ent.util.LabelSanitizer; import org.xml.sax.InputSource; import jakarta.xml.bind.JAXBContext; @@ -244,6 +245,7 @@ public void deleteResources(List resources) throws EntExcepti */ @Override public void addResource(ResourceInterface resource) throws EntException { + resource.setDescription(LabelSanitizer.stripMarkup(resource.getDescription())); try { this.generateAndSetResourceId(resource, resource.getId()); this.getResourceDAO().addResource(resource); @@ -268,7 +270,7 @@ public void updateResource(ResourceDataBean bean) throws EntException { ResourceInterface oldResource = this.loadResource(bean.getResourceId()); try { if (null == bean.getInputStream()) { - oldResource.setDescription(bean.getDescr()); + oldResource.setDescription(LabelSanitizer.stripMarkup(bean.getDescr())); oldResource.setCategories(bean.getCategories()); oldResource.setMetadata(bean.getMetadata()); oldResource.setMainGroup(bean.getMainGroup()); @@ -299,6 +301,7 @@ public void updateResource(ResourceDataBean bean) throws EntException { */ @Override public void updateResource(ResourceInterface resource) throws EntException { + resource.setDescription(LabelSanitizer.stripMarkup(resource.getDescription())); try { this.getResourceDAO().updateResource(resource); this.notifyResourceChanging(resource, ResourceChangedEvent.UPDATE_OPERATION_CODE); @@ -310,7 +313,7 @@ public void updateResource(ResourceInterface resource) throws EntException { protected ResourceInterface createResource(ResourceDataBean bean) throws EntException { ResourceInterface resource = this.createResourceType(bean.getResourceType()); - resource.setDescription(bean.getDescr()); + resource.setDescription(LabelSanitizer.stripMarkup(bean.getDescr())); resource.setMainGroup(bean.getMainGroup()); resource.setCategories(bean.getCategories()); resource.setMasterFileName(bean.getFileName()); diff --git a/engine/src/main/java/com/agiletec/aps/system/common/entity/ApsEntityManager.java b/engine/src/main/java/com/agiletec/aps/system/common/entity/ApsEntityManager.java index bd56e904e0..82ec4a72a1 100644 --- a/engine/src/main/java/com/agiletec/aps/system/common/entity/ApsEntityManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/common/entity/ApsEntityManager.java @@ -59,6 +59,7 @@ import org.apache.commons.beanutils.BeanComparator; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; +import org.entando.entando.ent.util.LabelSanitizer; import org.xml.sax.InputSource; import org.xml.sax.SAXException; @@ -271,6 +272,7 @@ public void updateEntityPrototype(IApsEntity entityType) throws EntException { if (null == entityType) { throw new EntException("Invalid entity type to update"); } + this.sanitizeEntityTypeLabels(entityType); Map entityTypes = this.getEntityTypes(); IApsEntity oldEntityType = entityTypes.get(entityType.getTypeCode()); if (null == oldEntityType) { @@ -282,6 +284,23 @@ public void updateEntityPrototype(IApsEntity entityType) throws EntException { this.notifyEntityTypesChanging(oldEntityType, entityType, EntityTypesChangingEvent.UPDATE_OPERATION_CODE); } + /** + * Strips markup from the user-supplied label fields of an entity type (its description + * and the name/description of each attribute) before it is persisted + */ + private void sanitizeEntityTypeLabels(IApsEntity entityType) { + entityType.setTypeCode(LabelSanitizer.stripMarkup(entityType.getTypeCode())); + entityType.setTypeDescription(LabelSanitizer.stripMarkup(entityType.getTypeDescription())); + List attributes = entityType.getAttributeList(); + if (null != attributes) { + for (AttributeInterface attribute : attributes) { + attribute.setName(LabelSanitizer.stripMarkup(attribute.getName())); + attribute.setDescription(LabelSanitizer.stripMarkup(attribute.getDescription())); + LabelSanitizer.stripMarkup(attribute.getNames()); + } + } + } + protected void verifyReloadingNeeded(IApsEntity oldEntityType, IApsEntity newEntityType) { if (this.getStatus(newEntityType.getTypeCode()) == STATUS_NEED_TO_RELOAD_REFERENCES) { return; diff --git a/engine/src/main/java/com/agiletec/aps/system/services/category/CategoryManager.java b/engine/src/main/java/com/agiletec/aps/system/services/category/CategoryManager.java index 393bf7ddbd..0967cee118 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/category/CategoryManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/category/CategoryManager.java @@ -23,6 +23,7 @@ import org.entando.entando.aps.system.services.tenants.RefreshableBeanTenantAware; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; +import org.entando.entando.ent.util.LabelSanitizer; import org.springframework.beans.factory.BeanFactoryUtils; import org.springframework.beans.factory.ListableBeanFactory; @@ -82,6 +83,8 @@ private void initCache() throws EntException { */ @Override public void addCategory(Category category) throws EntException { + category.setCode(LabelSanitizer.stripMarkup(category.getCode())); + LabelSanitizer.stripMarkup(category.getTitles()); try { this.getCategoryDAO().addCategory(category); this.getCacheWrapper().addCategory(category); @@ -121,6 +124,7 @@ public void deleteCategory(String code) throws EntException { */ @Override public void updateCategory(Category category) throws EntException { + LabelSanitizer.stripMarkup(category.getTitles()); try { this.getCategoryDAO().updateCategory(category); this.getCacheWrapper().updateCategory(category); diff --git a/engine/src/main/java/com/agiletec/aps/system/services/group/GroupManager.java b/engine/src/main/java/com/agiletec/aps/system/services/group/GroupManager.java index e77b7aa0d6..565e763929 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/group/GroupManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/group/GroupManager.java @@ -27,6 +27,7 @@ import org.apache.commons.beanutils.BeanComparator; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; +import org.entando.entando.ent.util.LabelSanitizer; /** * Servizio gestore dei gruppi. @@ -87,6 +88,7 @@ public void releaseTenantAware() { @Override public void addGroup(Group group) throws EntException { try { + group.setDescr(LabelSanitizer.stripMarkup(group.getDescr())); this.getGroupDAO().addGroup(group); this.getCacheWrapper().addGroup(group); } catch (Throwable t) { @@ -121,6 +123,7 @@ public void removeGroup(Group group) throws EntException { @Override public void updateGroup(Group group) throws EntException { try { + group.setDescr(LabelSanitizer.stripMarkup(group.getDescr())); this.getGroupDAO().updateGroup(group); this.getCacheWrapper().updateGroup(group); } catch (Throwable t) { diff --git a/engine/src/main/java/com/agiletec/aps/system/services/page/PageManager.java b/engine/src/main/java/com/agiletec/aps/system/services/page/PageManager.java index b1b0337c7d..b934f21318 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/page/PageManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/page/PageManager.java @@ -45,6 +45,7 @@ import org.entando.entando.ent.exception.EntException; import org.entando.entando.ent.util.EntLogging.EntLogFactory; import org.entando.entando.ent.util.EntLogging.EntLogger; +import org.entando.entando.ent.util.LabelSanitizer; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; @@ -131,6 +132,7 @@ public synchronized void deletePage(String pageCode) throws EntException { */ @Override public synchronized void addPage(IPage page) throws EntException { + LabelSanitizer.stripMarkup(page.getTitles()); try { IPage parent = this.getDraftPage(page.getParentCode()); if (null == parent) { @@ -165,6 +167,7 @@ public synchronized void addPage(IPage page) throws EntException { */ @Override public synchronized void updatePage(IPage page) throws EntException { + LabelSanitizer.stripMarkup(page.getTitles()); try { this.getPageDAO().updatePage(page); this.getCacheWrapper().updateDraftPage(page); diff --git a/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelManager.java b/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelManager.java index d61333449d..ba99896b5c 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelManager.java @@ -23,6 +23,7 @@ import org.entando.entando.aps.system.services.guifragment.GuiFragmentUtilizer; import org.entando.entando.ent.util.EntLogging.EntLogFactory; import org.entando.entando.ent.util.EntLogging.EntLogger; +import org.entando.entando.ent.util.LabelSanitizer; import java.util.*; import java.util.regex.*; @@ -87,6 +88,8 @@ public void addPageModel(PageModel pageModel) throws EntException { logger.debug("Null page template can be add"); return; } + pageModel.setCode(LabelSanitizer.stripMarkup(pageModel.getCode())); + pageModel.setDescription(LabelSanitizer.stripMarkup(pageModel.getDescription())); try { this.getPageModelDAO().addModel(pageModel); this.getCacheWrapper().addPageModel(pageModel); @@ -103,6 +106,8 @@ public void updatePageModel(PageModel pageModel) throws EntException { logger.debug("Null page template can be update"); return; } + pageModel.setCode(LabelSanitizer.stripMarkup(pageModel.getCode())); + pageModel.setDescription(LabelSanitizer.stripMarkup(pageModel.getDescription())); try { PageModel pageModelToUpdate = this.getCacheWrapper().getPageModel(pageModel.getCode()); if (null == pageModelToUpdate) { diff --git a/engine/src/main/java/com/agiletec/aps/system/services/role/RoleManager.java b/engine/src/main/java/com/agiletec/aps/system/services/role/RoleManager.java index 614d622fd9..8a3c0a592f 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/role/RoleManager.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/role/RoleManager.java @@ -25,6 +25,7 @@ import com.agiletec.aps.system.services.role.cache.IRoleCacheWrapper; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; +import org.entando.entando.ent.util.LabelSanitizer; /** * Servizio di gestione dei ruoli. @@ -110,6 +111,7 @@ public void removeRole(Role role) throws EntException { */ @Override public void updateRole(Role role) throws EntException { + role.setDescription(LabelSanitizer.stripMarkup(role.getDescription())); try { this.getRoleDAO().updateRole(role); this.getRoleCacheWrapper().updateRole(role); @@ -127,6 +129,7 @@ public void updateRole(Role role) throws EntException { */ @Override public void addRole(Role role) throws EntException { + role.setDescription(LabelSanitizer.stripMarkup(role.getDescription())); try { this.getRoleDAO().addRole(role); this.getRoleCacheWrapper().addRole(role); diff --git a/engine/src/main/java/org/entando/entando/aps/system/services/guifragment/GuiFragmentManager.java b/engine/src/main/java/org/entando/entando/aps/system/services/guifragment/GuiFragmentManager.java index d8ed2609c8..88c6895997 100644 --- a/engine/src/main/java/org/entando/entando/aps/system/services/guifragment/GuiFragmentManager.java +++ b/engine/src/main/java/org/entando/entando/aps/system/services/guifragment/GuiFragmentManager.java @@ -32,6 +32,7 @@ import org.entando.entando.aps.system.services.guifragment.event.GuiFragmentChangedEvent; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; +import org.entando.entando.ent.util.LabelSanitizer; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.cache.annotation.CacheEvict; @@ -128,6 +129,7 @@ protected FieldSearchFilter[] addFilter(FieldSearchFilter[] filters, FieldSearch @CacheEvict(value = ICacheInfoManager.DEFAULT_CACHE_NAME, key = "'GuiFragment_'.concat(#guiFragment.code)") public void addGuiFragment(GuiFragment guiFragment) throws EntException { try { + guiFragment.setCode(LabelSanitizer.stripMarkup(guiFragment.getCode())); this.getGuiFragmentDAO().insertGuiFragment(guiFragment); this.notifyGuiFragmentChangedEvent(guiFragment, GuiFragmentChangedEvent.INSERT_OPERATION_CODE); this.evictGroups(); @@ -141,6 +143,7 @@ public void addGuiFragment(GuiFragment guiFragment) throws EntException { @CacheEvict(value = ICacheInfoManager.DEFAULT_CACHE_NAME, key = "'GuiFragment_'.concat(#guiFragment.code)") public void updateGuiFragment(GuiFragment guiFragment) throws EntException { try { + guiFragment.setCode(LabelSanitizer.stripMarkup(guiFragment.getCode())); this.getGuiFragmentDAO().updateGuiFragment(guiFragment); this.notifyGuiFragmentChangedEvent(guiFragment, GuiFragmentChangedEvent.UPDATE_OPERATION_CODE); this.evictGroups(); diff --git a/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeManager.java b/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeManager.java index 13b7aa5451..4229570b2a 100644 --- a/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeManager.java +++ b/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeManager.java @@ -30,6 +30,7 @@ import org.entando.entando.ent.exception.EntException; import org.entando.entando.ent.util.EntLogging.EntLogFactory; import org.entando.entando.ent.util.EntLogging.EntLogger; +import org.entando.entando.ent.util.LabelSanitizer; import java.util.ArrayList; import java.util.Collections; @@ -120,6 +121,7 @@ public void addWidgetType(WidgetType widgetType) throws EntException { if (null != widgetType.getTypeParameters() && null != widgetType.getConfig()) { throw new EntException("ERROR : Params not null and config not null"); } + LabelSanitizer.stripMarkup(widgetType.getTitles()); this.getWidgetTypeDAO().addWidgetType(widgetType); this.getCacheWrapper().addWidgetType(widgetType); this.notifyWidgetTypeChanging(widgetType.getCode(), WidgetTypeChangedEvent.INSERT_OPERATION_CODE); @@ -220,6 +222,7 @@ public void updateWidgetType(String widgetTypeCode, ApsProperties titles, ApsPro } else { readonlyPageWidgetConfigLocalVar = readonlyPageWidgetConfig; } + LabelSanitizer.stripMarkup(titles); this.getWidgetTypeDAO().updateWidgetType(widgetTypeCode, titles, defaultConfig, mainGroup, configUi, bundleId, readonlyPageWidgetConfigLocalVar, widgetCategory, icon); type.setTitles(titles); type.setConfig(defaultConfig); diff --git a/engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java b/engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java index 1adb08e9c8..507676d7e8 100644 --- a/engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java +++ b/engine/src/main/java/org/entando/entando/ent/util/LabelSanitizer.java @@ -45,8 +45,8 @@ public static void stripMarkup(ApsProperties properties) { } for (Object key : new ArrayList<>(properties.keySet())) { Object value = properties.get(key); - if (value instanceof String) { - properties.put(key, stripMarkup((String) value)); + if (value instanceof String s) { + properties.put(key, stripMarkup(s)); } } }