CVE-2025-43753

@@ -3028,16 +3028,11 @@ private void _testRenderFormWithSuccessMessage(
 
 		String content = mockHttpServletResponse.getContentAsString();
 
-		String formStartHTML = "<form action=\"";
-
-		Assert.assertFalse(content.contains(formStartHTML));
-
+		Assert.assertFalse(
+			content.contains("<form action=\""));
+		Assert.assertFalse(
+			content.contains("<p>InputName:" + infoField.getName() + "</p>"));
 		Assert.assertTrue(content, content.contains(expectedSuccessHTML));
-
-		String expectedInfoFieldInput =
-			"<p>InputName:" + infoField.getName() + "</p>";
-
-		Assert.assertFalse(content.contains(expectedInfoFieldInput));
 	}
 
 	private void _testRenderLayoutWithLocale(

@@ -1920,6 +1920,44 @@ public void testRenderFormWithSuccessMessage() throws Exception {
 							"received"),
 					"</div>"),
 				formItemId, infoField, layout);
+
+			Layout draftLayout = layout.fetchDraftLayout();
+
+			long segmentsExperienceId =
+				_segmentsExperienceLocalService.
+					fetchDefaultSegmentsExperienceId(draftLayout.getPlid());
+
+			LayoutStructure layoutStructure =
+				_layoutStructureProvider.getLayoutStructure(
+					draftLayout.getPlid(), segmentsExperienceId);
+
+			List<FormStyledLayoutStructureItem> formStyledLayoutStructureItems =
+				layoutStructure.getFormStyledLayoutStructureItems();
+
+			FormStyledLayoutStructureItem formStyledLayoutStructureItem =
+				formStyledLayoutStructureItems.get(0);
+
+			String message =
+				"<script>alert('" + RandomTestUtil.randomString() +
+					"')</script>";
+
+			formStyledLayoutStructureItem.setSuccessMessageJSONObject(
+				JSONUtil.put(
+					"message",
+					JSONUtil.put(LocaleUtil.toLanguageId(locale), message)
+				).put(
+					"type", "embedded"
+				));
+
+			_layoutPageTemplateStructureLocalService.
+				updateLayoutPageTemplateStructureData(
+					_group.getGroupId(), draftLayout.getPlid(),
+					segmentsExperienceId, layoutStructure.toString());
+
+			ContentLayoutTestUtil.publishLayout(draftLayout, layout);
+
+			_testRenderFormWithSuccessMessage(
+				HtmlUtil.escape(message), formItemId, infoField, layout);
 		}
 	}
 

@@ -1908,37 +1908,18 @@ public void testRenderFormWithSuccessMessage() throws Exception {
 					_portal.getClassNameId(MockObject.class.getName())),
 				"0", layout, _layoutStructureProvider, infoField);
 
-			MockHttpServletRequest mockHttpServletRequest =
-				_getMockHttpServletRequest(layout);
-
-			SessionMessages.add(mockHttpServletRequest, formItemId);
-
-			MockHttpServletResponse mockHttpServletResponse = _renderLayout(
-				layout, mockHttpServletRequest);
-
-			String content = mockHttpServletResponse.getContentAsString();
-
-			String formStartHTML = "<form action=\"";
-
-			Assert.assertFalse(content.contains(formStartHTML));
-
 			Locale locale = _portal.getSiteDefaultLocale(_group);
 
-			String expectedSuccessMessage = LanguageUtil.get(
-				locale,
-				"thank-you.-your-information-was-successfully-received");
-
-			String expectedSuccessHTML = StringBundler.concat(
-				"<div class=\"bg-white font-weight-semi-bold p-5 text-3 ",
-				"text-center text-secondary\">", expectedSuccessMessage,
-				"</div>");
-
-			Assert.assertTrue(content.contains(expectedSuccessHTML));
-
-			String expectedInfoFieldInput =
-				"<p>InputName:" + infoField.getName() + "</p>";
-
-			Assert.assertFalse(content.contains(expectedInfoFieldInput));
+			_testRenderFormWithSuccessMessage(
+				StringBundler.concat(
+					"<div class=\"bg-white font-weight-semi-bold p-5 text-3 ",
+					"text-center text-secondary\">",
+					LanguageUtil.get(
+						locale,
+						"thank-you.-your-information-was-successfully-" +
+							"received"),
+					"</div>"),
+				formItemId, infoField, layout);
 		}
 	}
 
@@ -2993,6 +2974,33 @@ private void _testPagination(
 		}
 	}
 
+	private void _testRenderFormWithSuccessMessage(
+			String expectedSuccessHTML, String formItemId,
+			InfoField<TextInfoFieldType> infoField, Layout layout)
+		throws Exception {
+
+		MockHttpServletRequest mockHttpServletRequest =
+			_getMockHttpServletRequest(layout);
+
+		SessionMessages.add(mockHttpServletRequest, formItemId);
+
+		MockHttpServletResponse mockHttpServletResponse = _renderLayout(
+			layout, mockHttpServletRequest);
+
+		String content = mockHttpServletResponse.getContentAsString();
+
+		String formStartHTML = "<form action=\"";
+
+		Assert.assertFalse(content.contains(formStartHTML));
+
+		Assert.assertTrue(content, content.contains(expectedSuccessHTML));
+
+		String expectedInfoFieldInput =
+			"<p>InputName:" + infoField.getName() + "</p>";
+
+		Assert.assertFalse(content.contains(expectedInfoFieldInput));
+	}
+
 	private void _testRenderLayoutWithLocale(
 			Layout layout, Locale locale, String... strings)
 		throws Exception {

@@ -1888,6 +1888,7 @@ public void testRenderFormWithoutErrors() throws Exception {
 	}
 
 	@Test
+	@TestInfo("LPD-52923")
 	public void testRenderFormWithSuccessMessage() throws Exception {
 		InfoField<TextInfoFieldType> infoField = _getInfoField(false);
 

@@ -62,6 +62,7 @@
 import com.liferay.portal.kernel.util.Constants;
 import com.liferay.portal.kernel.util.GetterUtil;
 import com.liferay.portal.kernel.util.HashMapBuilder;
+import com.liferay.portal.kernel.util.HtmlUtil;
 import com.liferay.portal.kernel.util.ParamUtil;
 import com.liferay.portal.kernel.util.PortalUtil;
 import com.liferay.portal.kernel.util.SetUtil;
@@ -663,16 +664,16 @@ public String getSuccessMessage(
 			JSONObject messageJSONObject =
 				successMessageJSONObject.getJSONObject("message");
 
-			successMessage = messageJSONObject.getString(
-				_themeDisplay.getLanguageId());
+			successMessage = HtmlUtil.escape(
+				messageJSONObject.getString(_themeDisplay.getLanguageId()));
 
 			if (Validator.isNull(successMessage)) {
 				String siteDefaultLanguageId = LanguageUtil.getLanguageId(
 					PortalUtil.getSiteDefaultLocale(
 						_themeDisplay.getScopeGroupId()));
 
-				successMessage = messageJSONObject.getString(
-					siteDefaultLanguageId);
+				successMessage = HtmlUtil.escape(
+					messageJSONObject.getString(siteDefaultLanguageId));
 			}
 		}