Port fix for bug 40901. Encode directory listing output. Based on a patch by Chris...

git-svn-id: https://svn.apache.org/repos/asf/tomcat/tc6.0.x/trunk@476992 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/java/org/apache/catalina/servlets/DefaultServlet.java b/java/org/apache/catalina/servlets/DefaultServlet.java
index 46bb7e8..8afbaaf 100644 (file)
--- a/java/org/apache/catalina/servlets/DefaultServlet.java
+++ b/java/org/apache/catalina/servlets/DefaultServlet.java
@@ -56,6 +56,7 @@ import javax.xml.transform.stream.StreamResult;
 import javax.xml.transform.stream.StreamSource;
 
 import org.apache.catalina.Globals;
+import org.apache.catalina.util.RequestUtil;
 import org.apache.catalina.util.ServerInfo;
 import org.apache.catalina.util.StringManager;
 import org.apache.catalina.util.URLEncoder;
@@ -1171,7 +1172,7 @@ public class DefaultServlet
                   .append("'");
 
                 sb.append(">");
-                sb.append(trimmed);
+                sb.append(RequestUtil.filter(trimmed));
                 if (childCacheEntry.context != null)
                     sb.append("/");
                 sb.append("</entry>");
@@ -1333,7 +1334,7 @@ public class DefaultServlet
                 if (childCacheEntry.context != null)
                     sb.append("/");
                 sb.append("\"><tt>");
-                sb.append(trimmed);
+                sb.append(RequestUtil.filter(trimmed));
                 if (childCacheEntry.context != null)
                     sb.append("/");
                 sb.append("</tt></a></td>\r\n");

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 9c9eec9..736332f 100644 (file)
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -28,6 +28,10 @@
       <fix>
         <bug>40844</bug> Missing syncs in JDBCRealm. (markt)
       </fix>
+       <fix>
+        <bug>40901</bug>: Encode directory listing output. Based on a patch
+        provided by Chris Halstead. (markt)
+      </fix>
       <fix>
         <bug>40929</bug>: Correct JavaDoc for StandardClassLoader. (markt)
         (markt)