Author: jfrederic.clere(a)jboss.com Date: 2008-07-25 12:26:00 -0400 (Fri, 25 Jul 2008) New Revision: 730 Modified: branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/manager/host/HTMLHostManagerServlet.java Log: Very minor XSS problem. Modified: branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/manager/host/HTMLHostManagerServlet.java =================================================================== --- branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/manager/host/HTMLHostManagerServlet.java 2008-07-25 16:14:15 UTC (rev 729) +++ branches/JBOSSWEB_2_0_0_GA_CP/src/share/classes/org/apache/catalina/manager/host/HTMLHostManagerServlet.java 2008-07-25 16:26:00 UTC (rev 730) @@ -21,6 +21,7 @@ import java.io.IOException; import java.io.PrintWriter; import java.io.StringWriter; +import java.net.URLEncoder; import java.text.MessageFormat; import java.util.Iterator; import java.util.Map; @@ -276,17 +277,17 @@ args = new Object[7]; args[0] = response.encodeURL (request.getContextPath() + - "/html/start?name=" + hostName); + "/html/start?name=" + URLEncoder.encode(hostName, "UTF-8")); args[1] = hostsStart; args[2] = response.encodeURL (request.getContextPath() + - "/html/stop?name=" + hostName); + "/html/stop?name=" + URLEncoder.encode(hostName, "UTF-8")); args[3] = hostsStop; args[4] = response.encodeURL (request.getContextPath() + - "/html/remove?name=" + hostName); + "/html/remove?name=" + URLEncoder.encode(hostName, "UTF-8")); args[5] = hostsRemove; - args[6] = hostName; + args[6] = RequestUtil.filter(hostName); if (host == this.host) { writer.print(MessageFormat.format( MANAGER_HOST_ROW_BUTTON_SECTION, args));