You are viewing a plain text version of this content. The canonical link for it is here.
Posted to pluto-scm@portals.apache.org by as...@apache.org on 2019/04/16 18:36:38 UTC
[portals-pluto] branch master updated: PLUTO-779 Chat Room demo
portlet input values need to be escaped
This is an automated email from the ASF dual-hosted git repository.
asfgriff pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/portals-pluto.git
The following commit(s) were added to refs/heads/master by this push:
new 57ff581 PLUTO-779 Chat Room demo portlet input values need to be escaped
57ff581 is described below
commit 57ff581b7b37567ad695222981cf63568c6a8893
Author: Neil Griffin <ne...@gmail.com>
AuthorDate: Tue Apr 16 14:36:13 2019 -0400
PLUTO-779 Chat Room demo portlet input values need to be escaped
---
demo/chat-room-demo-portlet/pom.xml | 4 ++++
.../src/main/java/org/apache/portals/pluto/demo/chat/ChatHistory.java | 4 +++-
.../java/org/apache/portals/pluto/demo/chat/HelloWorldRender.java | 4 +++-
3 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/demo/chat-room-demo-portlet/pom.xml b/demo/chat-room-demo-portlet/pom.xml
index e37d88d..1e4b2e4 100644
--- a/demo/chat-room-demo-portlet/pom.xml
+++ b/demo/chat-room-demo-portlet/pom.xml
@@ -43,6 +43,10 @@
<version>6.0</version>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-lang3</artifactId>
+ </dependency>
<!-- for eclipse JSP tooling purposes -->
<dependency>
<groupId>javax.servlet.jsp</groupId>
diff --git a/demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/ChatHistory.java b/demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/ChatHistory.java
index df82f6a..b9f61cf 100644
--- a/demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/ChatHistory.java
+++ b/demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/ChatHistory.java
@@ -18,6 +18,8 @@
package org.apache.portals.pluto.demo.chat;
+import org.apache.commons.lang3.StringEscapeUtils;
+
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
@@ -66,7 +68,7 @@ public class ChatHistory {
StringBuilder txt = new StringBuilder(128);
synchronized (messages) {
for (String msg : messages) {
- txt.append("<p>").append(msg).append("</p>\n");
+ txt.append("<p>").append(StringEscapeUtils.escapeHtml4(msg)).append("</p>\n");
}
}
return txt.toString();
diff --git a/demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/HelloWorldRender.java b/demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/HelloWorldRender.java
index 50ac6be..6eaa623 100644
--- a/demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/HelloWorldRender.java
+++ b/demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/HelloWorldRender.java
@@ -19,6 +19,8 @@
package org.apache.portals.pluto.demo.chat;
+import org.apache.commons.lang3.StringEscapeUtils;
+
import javax.inject.Inject;
import javax.portlet.annotations.RenderMethod;
@@ -48,7 +50,7 @@ public class HelloWorldRender {
txt.append("<h3>Hello \n");
// Get the name from the bean. If it hasn't been set, just greet the world.
if (nameBean.getName() != null) {
- txt.append(nameBean.getName());
+ txt.append(StringEscapeUtils.escapeHtml4(nameBean.getName()));
} else {
txt.append("World\n");
}