Author: jfrederic.clere(a)jboss.com Date: 2011-02-10 09:32:32 -0500 (Thu, 10 Feb 2011) New Revision: 1654 Modified: branches/2.1.x/java/org/apache/catalina/manager/HTMLManagerServlet.java branches/2.1.x/java/org/apache/catalina/manager/StatusTransformer.java Log: Fix for CVE-2011-0013. Modified: branches/2.1.x/java/org/apache/catalina/manager/HTMLManagerServlet.java =================================================================== --- branches/2.1.x/java/org/apache/catalina/manager/HTMLManagerServlet.java 2011-02-10 10:22:18 UTC (rev 1653) +++ branches/2.1.x/java/org/apache/catalina/manager/HTMLManagerServlet.java 2011-02-10 14:32:32 UTC (rev 1654) @@ -406,10 +406,11 @@ args = new Object[7]; args[0] = URL_ENCODER.encode(displayPath); - args[1] = displayPath; - args[2] = context.getDisplayName(); - if (args[2] == null) { + args[1] = RequestUtil.filter(displayPath); + if (context.getDisplayName() == null) { args[2] = "&nbsp;"; + } else { + args[2] = RequestUtil.filter(context.getDisplayName()); } args[3] = new Boolean(context.getAvailable()); args[4] = response.encodeURL Modified: branches/2.1.x/java/org/apache/catalina/manager/StatusTransformer.java =================================================================== --- branches/2.1.x/java/org/apache/catalina/manager/StatusTransformer.java 2011-02-10 10:22:18 UTC (rev 1653) +++ branches/2.1.x/java/org/apache/catalina/manager/StatusTransformer.java 2011-02-10 14:32:32 UTC (rev 1654) @@ -623,7 +623,7 @@ } writer.print("<a href=\"#" + (count++) + ".0\">"); - writer.print(webModuleName); + writer.print(filter(webModuleName)); writer.print("</a>"); writer.print("</dd>"); } @@ -684,7 +684,7 @@ } writer.print("<h3>"); - writer.print(name); + writer.print(filter(name)); writer.print("</h3>"); writer.print("</a>"); @@ -810,11 +810,11 @@ mBeanServer.invoke(objectName, "findMappings", null, null); writer.print("<h2>"); - writer.print(servletName); + writer.print(filter(servletName)); if ((mappings != null) && (mappings.length > 0)) { writer.print(" [ "); for (int i = 0; i < mappings.length; i++) { - writer.print(mappings[i]); + writer.print(filter(mappings[i])); if (i < mappings.length - 1) { writer.print(" , "); }