Validate and Sanitize backToUrl in self-registration-username-request.jsp

[KD23243]

Purpose

This pull request includes changes to the self-registration-username-request.jsp file in the identity-apps-core/apps/recovery-portal/src/main/webapp directory. The changes primarily focus on improving security and error handling for callback URLs.

Improvements to security and error handling:

• Sanitization: Added proper sanitization to the query parameter in the "Sign in" button.
• Callback URL Validation: The backToUrl parameter is now validated using Utils.validateCallbackURL and is checked against a configured callback regex.
• Error Handling: Incorporated a try-catch block to handle invalid URLs. If the URL is invalid, the system now redirects to error.jsp with a corresponding error message.
• HTML Escaping: The href attribute for the "Sign in" button has been updated to escape HTML characters in the backToUrl parameter using StringEscapeUtils.escapeHtml4.

Checklist

• e2e cypress tests locally verified. (for internal contributers)
• Manual test round performed and verified.
• UX/UI review done on the final implementation.
• Documentation provided. (Add links if there are any)
• Relevant backend changes deployed and verified
• Unit tests provided. (Add links if there are any)
• Integration tests provided. (Add links if there are any)

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines
• Ran FindSecurityBugs plugin and verified report
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 32.32%. Comparing base (de6e955) to head (79a63a6).
Report is 29 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #7250   +/-   ##
=======================================
  Coverage   32.32%   32.32%           
=======================================
  Files          42       42           
  Lines         897      897           
  Branches      204      204           
=======================================
  Hits          290      290           
  Misses        607      607           

Flag	Coverage Δ
@wso2is/core	32.32% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[wso2-jenkins-bot]

🦋 Changeset detected

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.