Wrong text displayed in SA when no activation helptext is set

[peterclijsters1]

When LoA1.5 is active for an institution, and no help text is set to be shown in SA, a wrong text is displayed:

Replay with institution-a on sa.test.surfconext.nl

[phavekes]

@peterclijsters1 This looks like a security audit leftover. What institution was this?

[pmeulen]

Verified that this issue still exists in SelfService 5.0.5

[MKodde]

I am not able to reproduce this in a clean dev env.

---

In SA: I grepped the project for the '"><script src=x onerror=alert()>' but to no avail.

---

In RA I have tried to:

• save an empty institution help message
• a non empty message (only a couple of whitespaces)

In both cases the message is not displayed in SA.

I wanted to log in as a RAA in the test env, but my michiel account seems to be removed from the 'Pieter AAI'.

---

My assumption is that the xss string was entered in the RA 'vetting-type-hint' page for institution-a. And that is it just showing that string 'correctly'. Too bad I can not confirm this myself.

@peterclijsters1 or @pmeulen can one of you confirm this for me?