You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2008/06/02 23:41:29 UTC
svn commit: r662582 -
/tomcat/trunk/java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java
Author: markt
Date: Mon Jun 2 14:41:28 2008
New Revision: 662582
URL: http://svn.apache.org/viewvc?rev=662582&view=rev
Log:
Fix potential XSS in host-manager.
This is CVE-2008-1947.
Modified:
tomcat/trunk/java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java
Modified: tomcat/trunk/java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java
URL: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java?rev=662582&r1=662581&r2=662582&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java (original)
+++ tomcat/trunk/java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java Mon Jun 2 14:41:28 2008
@@ -21,6 +21,7 @@
import java.io.IOException;
import java.io.PrintWriter;
import java.io.StringWriter;
+import java.net.URLEncoder;
import java.text.MessageFormat;
import java.util.Iterator;
import java.util.Map;
@@ -278,17 +279,20 @@
args = new Object[7];
args[0] = response.encodeURL
(request.getContextPath() +
- "/html/start?name=" + hostName);
+ "/html/start?name=" +
+ URLEncoder.encode(hostName, "UTF-8"));
args[1] = hostsStart;
args[2] = response.encodeURL
(request.getContextPath() +
- "/html/stop?name=" + hostName);
+ "/html/stop?name=" +
+ URLEncoder.encode(hostName, "UTF-8"));
args[3] = hostsStop;
args[4] = response.encodeURL
(request.getContextPath() +
- "/html/remove?name=" + hostName);
+ "/html/remove?name=" +
+ URLEncoder.encode(hostName, "UTF-8"));
args[5] = hostsRemove;
- args[6] = hostName;
+ args[6] = RequestUtil.filter(hostName);
if (host == this.host) {
writer.print(MessageFormat.format(
MANAGER_HOST_ROW_BUTTON_SECTION, args));
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org