[jboss-cvs] JBossAS SVN: r77029 - branches/Branch_4_2/varia/src/main/org/jboss/jmx/adaptor/html.

[jboss-cvs-commits at lists.jboss.org]

Author: csaldanh
Date: 2008-08-13 15:30:39 -0400 (Wed, 13 Aug 2008)
New Revision: 77029

Modified:
   branches/Branch_4_2/varia/src/main/org/jboss/jmx/adaptor/html/HtmlAdaptorServlet.java
Log:
JBAS-5855: Fix for XSS in jmx-console


Modified: branches/Branch_4_2/varia/src/main/org/jboss/jmx/adaptor/html/HtmlAdaptorServlet.java
===================================================================
--- branches/Branch_4_2/varia/src/main/org/jboss/jmx/adaptor/html/HtmlAdaptorServlet.java	2008-08-13 19:03:15 UTC (rev 77028)
+++ branches/Branch_4_2/varia/src/main/org/jboss/jmx/adaptor/html/HtmlAdaptorServlet.java	2008-08-13 19:30:39 UTC (rev 77029)
@@ -172,6 +172,9 @@
          filter = "";
       }
 
+      //Change "<" and ">" to "&lt;" and "&gt;" in filter string
+      filter = translateMetaCharacters(filter);
+
       // update request filter and store filter in session context,
       // so it can be used when no filter has been submitted in
       // current request
@@ -329,5 +332,14 @@
       argList.toArray(args);
       return args;
    }
+
+   /** Translate html metacharacters in filter string only '<' and '>'
+   */
+   private String translateMetaCharacters(String s)
+   {
+     s = s.replaceAll("<","&lt;");
+     s = s.replaceAll(">","&gt;");
+     return s;
+   }
 }