You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@struts.apache.org by lu...@apache.org on 2012/09/12 08:17:25 UTC

svn commit: r1383793 - /struts/struts2/trunk/apps/showcase/src/main/java/org/apache/struts2/showcase/model/Skill.java

Author: lukaszlenart
Date: Wed Sep 12 06:17:24 2012
New Revision: 1383793

URL: http://svn.apache.org/viewvc?rev=1383793&view=rev
Log:
Sanitise input variables

Modified:
    struts/struts2/trunk/apps/showcase/src/main/java/org/apache/struts2/showcase/model/Skill.java

Modified: struts/struts2/trunk/apps/showcase/src/main/java/org/apache/struts2/showcase/model/Skill.java
URL: http://svn.apache.org/viewvc/struts/struts2/trunk/apps/showcase/src/main/java/org/apache/struts2/showcase/model/Skill.java?rev=1383793&r1=1383792&r2=1383793&view=diff
==============================================================================
--- struts/struts2/trunk/apps/showcase/src/main/java/org/apache/struts2/showcase/model/Skill.java (original)
+++ struts/struts2/trunk/apps/showcase/src/main/java/org/apache/struts2/showcase/model/Skill.java Wed Sep 12 06:17:24 2012
@@ -20,6 +20,8 @@
  */
 package org.apache.struts2.showcase.model;
 
+import org.apache.commons.lang3.StringEscapeUtils;
+
 import java.io.Serializable;
 
 /**
@@ -47,7 +49,7 @@ public class Skill implements IdEntity {
     }
 
     public void setName(String name) {
-        this.name = name;
+        this.name = StringEscapeUtils.escapeEcmaScript(StringEscapeUtils.escapeHtml4(name));
     }
 
     public String getDescription() {
@@ -55,7 +57,7 @@ public class Skill implements IdEntity {
     }
 
     public void setDescription(String description) {
-        this.description = description;
+        this.description = StringEscapeUtils.escapeEcmaScript(StringEscapeUtils.escapeHtml4(description));
     }
 
     public Serializable getId() {