[cxf] branch 3.3.x-fixes updated: Escape the services listing stylesheet path (#694)

[co...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 3.3.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/3.3.x-fixes by this push:
     new dc6229b  Escape the services listing stylesheet path (#694)
dc6229b is described below

commit dc6229b0272d39065393677ee607be9ca3b0d216
Author: Colm O hEigeartaigh <co...@users.noreply.github.com>
AuthorDate: Wed Sep 23 07:33:04 2020 +0100

    Escape the services listing stylesheet path (#694)
    
    (cherry picked from commit 3c23fa3b3c24c328bbc6d71c509668cb10b0ea31)
---
 .../cxf/transport/servlet/servicelist/FormattedServiceListWriter.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.java
index c453e5a..9cc2cb4 100644
--- a/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.java
+++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.java
@@ -42,7 +42,7 @@ public class FormattedServiceListWriter implements ServiceListWriter {
                                       String title,
                                       boolean showForeignContexts,
                                       Bus bus) {
-        this.styleSheetPath = styleSheetPath;
+        this.styleSheetPath = StringEscapeUtils.escapeHtml4(styleSheetPath);
         this.title = title;
         this.showForeignContexts = showForeignContexts;
         this.bus = bus;