[jbossweb-commits] JBossWeb SVN: r730 - branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/manager/host.
Author: jfrederic.clere(a)jboss.com
Date: 2008-07-25 12:26:00 -0400 (Fri, 25 Jul 2008)
New Revision: 730
Modified:
branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/manager/host/HTMLHostManagerServlet.java
Log:
Very minor XSS problem.
Modified:
branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/manager/host/HTMLHostManagerServlet.java
===================================================================
---
branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/manager/host/HTMLHostManagerServlet.java 2008-07-25
16:14:15 UTC (rev 729)
+++
branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/manager/host/HTMLHostManagerServlet.java 2008-07-25
16:26:00 UTC (rev 730)
@@ -21,6 +21,7 @@
import java.io.IOException;
import java.io.PrintWriter;
import java.io.StringWriter;
+import java.net.URLEncoder;
import java.text.MessageFormat;
import java.util.Iterator;
import java.util.Map;
@@ -276,17 +277,17 @@
args = new Object[7];
args[0] = response.encodeURL
(request.getContextPath() +
- "/html/start?name=" + hostName);
+ "/html/start?name=" + URLEncoder.encode(hostName,
"UTF-8"));
args[1] = hostsStart;
args[2] = response.encodeURL
(request.getContextPath() +
- "/html/stop?name=" + hostName);
+ "/html/stop?name=" + URLEncoder.encode(hostName,
"UTF-8"));
args[3] = hostsStop;
args[4] = response.encodeURL
(request.getContextPath() +
- "/html/remove?name=" + hostName);
+ "/html/remove?name=" + URLEncoder.encode(hostName,
"UTF-8"));
args[5] = hostsRemove;
- args[6] = hostName;
+ args[6] = RequestUtil.filter(hostName);
if (host == this.host) {
writer.print(MessageFormat.format(
MANAGER_HOST_ROW_BUTTON_SECTION, args));