You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2006/11/06 05:38:27 UTC
DO NOT REPLY [Bug 40901] New: - listings page does not escape XML characters
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40901>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40901
Summary: listings page does not escape XML characters
Product: Tomcat 5
Version: 5.5.17
Platform: Other
OS/Version: Solaris
Status: NEW
Severity: normal
Priority: P2
Component: Unknown
AssignedTo: tomcat-dev@jakarta.apache.org
ReportedBy: dies@jp.fujitsu.com
On Solaris you can have a file or directory name called "<b>xxx" or "<i>yyy".
Using Tomcat's listings feature, you get a directory listing with the file name
in bold or italics.
I am not familiar with Javascript or cross-site scripting security problems, but
I believe Tomcat escapes XML characters like ">" and "<" to prevent client
browsers to interpret HTML codes that are not intended to be interpreted as such
for the default error page.
I think the same should be done for listings, or a warning should be added to
the documentation not to use it if you have no control over the file/directory
names you list.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40901] - listings page does not escape XML characters
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40901>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40901
------- Additional Comments From chris@sourcelabs.com 2006-11-06 14:04 -------
Created an attachment (id=19093)
--> (http://issues.apache.org/bugzilla/attachment.cgi?id=19093&action=view)
Patch to DefaultServlet.java that HTML-encodes filenames for directory indexing
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40901] - listings page does not escape XML characters
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40901>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40901
markt@apache.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
------- Additional Comments From markt@apache.org 2006-11-10 13:17 -------
many thanks for the patch. A variation has been applied to SVN and will be
included in 5.5.21 onwards.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40901] - listings page does not escape XML characters
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40901>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40901
------- Additional Comments From dies@jp.fujitsu.com 2006-11-06 16:07 -------
Thanks Chris!
BTW: the file/directory names should be "<b>xxx<b>", "<i>yyy<i>" to get the HTML
code interpreted by the browser. Somehow I lost the end tags in my posting.
I tried jarring them up and unjarring them to Windows to see if I could
reproduce it there. Alas, IOExc during unjarring.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40901] - listings page does not escape XML characters
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40901>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40901
------- Additional Comments From chris@sourcelabs.com 2006-11-06 14:04 -------
Confirmed on Linux as well. I'm attaching a simple patch that incorporates
basic HTML encoding into o.a.catalina.servlets.DefaultServlet when outputting a
directory index (whether as HTML or XML). The method in question is basically
the same as used in o.a.catalina.util.DOMWriter and in HTMLFilter.java in the
JSR152/154 examples.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org