projects / tomcat7.0 / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 6793f6e)
Fix XSS issues in snoop.jsp. This is CVE-2007-2449. Some of these are harder (impossi...
authormarkt <markt@13f79535-47bb-0310-9956-ffa450edef68>
Thu, 14 Jun 2007 02:01:19 +0000 (02:01 +0000)
committermarkt <markt@13f79535-47bb-0310-9956-ffa450edef68>
Thu, 14 Jun 2007 02:01:19 +0000 (02:01 +0000)
I also made a similar change for a couple of other JSPs that are in the harder/impossible? to exploit category.

git-svn-id: https://svn.apache.org/repos/asf/tomcat/tc6.0.x/trunk@547081 13f79535-47bb-0310-9956-ffa450edef68

webapps/examples/jsp/security/protected/index.jsp patch | blob | history
webapps/examples/jsp/snp/snoop.html patch | blob | history
webapps/examples/jsp/snp/snoop.jsp patch | blob | history
webapps/examples/jsp/source.jsp patch | blob | history

diff --git a/webapps/examples/jsp/security/protected/index.jsp b/webapps/examples/jsp/security/protected/index.jsp
index f7585eb..d2e84be 100644 (file)
--- a/webapps/examples/jsp/security/protected/index.jsp
+++ b/webapps/examples/jsp/security/protected/index.jsp
@@ -27,14 +27,16 @@
 </head>
 <body bgcolor="white">
 
-You are logged in as remote user <b><%= request.getRemoteUser() %></b>
+You are logged in as remote user
+<b><%= util.HTMLFilter.filter(request.getRemoteUser()) %></b>
 in session <b><%= session.getId() %></b><br><br>
 
 <%
   if (request.getUserPrincipal() != null) {
 %>
     Your user principal name is
-    <b><%= request.getUserPrincipal().getName() %></b><br><br>
+    <b><%= util.HTMLFilter.filter(request.getUserPrincipal().getName()) %></b>
+    <br><br>
 <%
   } else {
 %>
diff --git a/webapps/examples/jsp/snp/snoop.html b/webapps/examples/jsp/snp/snoop.html
index 0f1f088..e48355b 100644 (file)
--- a/webapps/examples/jsp/snp/snoop.html
+++ b/webapps/examples/jsp/snp/snoop.html
@@ -24,8 +24,8 @@
 <body bgcolor="#FFFFFF">
 <p><font color="#0000FF"><a href="snoop.jsp"><img src="../images/execute.gif" align="right" border="0"></a><a href="../index.html"><img src="../images/return.gif" width="24" height="24" align="right" border="0"></a></font></p>
 
-<h3><a href="snoop.jsp.html">Source Code for Request Parameters Example<font color="#0000FF"></a>
-  </font> </h3>
+<h3><a href="snoop.jsp.html">Source Code for Request Parameters Example<font color="#0000FF">
+  </font></a></h3>
 
 </body>
 </html>
diff --git a/webapps/examples/jsp/snp/snoop.jsp b/webapps/examples/jsp/snp/snoop.jsp
index 9b979ee..c8561de 100644 (file)
--- a/webapps/examples/jsp/snp/snoop.jsp
+++ b/webapps/examples/jsp/snp/snoop.jsp
@@ -19,37 +19,38 @@
 <body bgcolor="white">
 <h1> Request Information </h1>
 <font size="4">
-JSP Request Method: <% out.print(util.HTMLFilter.filter(request.getMethod())); %>
+JSP Request Method: <%= util.HTMLFilter.filter(request.getMethod()) %>
 <br>
-Request URI: <%= request.getRequestURI() %>
+Request URI: <%= util.HTMLFilter.filter(request.getRequestURI()) %>
 <br>
-Request Protocol: <%= request.getProtocol() %>
+Request Protocol: <%= util.HTMLFilter.filter(request.getProtocol()) %>
 <br>
-Servlet path: <%= request.getServletPath() %>
+Servlet path: <%= util.HTMLFilter.filter(request.getServletPath()) %>
 <br>
-Path info: <% out.print(util.HTMLFilter.filter(request.getPathInfo())); %>
+Path info: <%= util.HTMLFilter.filter(request.getPathInfo()) %>
 <br>
-Query string: <% out.print(util.HTMLFilter.filter(request.getQueryString())); %>
+Query string: <%= util.HTMLFilter.filter(request.getQueryString()) %>
 <br>
 Content length: <%= request.getContentLength() %>
 <br>
-Content type: <% out.print(util.HTMLFilter.filter(request.getContentType())); %>
+Content type: <%= util.HTMLFilter.filter(request.getContentType()) %>
 <br>
-Server name: <%= request.getServerName() %>
+Server name: <%= util.HTMLFilter.filter(request.getServerName()) %>
 <br>
 Server port: <%= request.getServerPort() %>
 <br>
-Remote user: <%= request.getRemoteUser() %>
+Remote user: <%= util.HTMLFilter.filter(request.getRemoteUser()) %>
 <br>
-Remote address: <%= request.getRemoteAddr() %>
+Remote address: <%= util.HTMLFilter.filter(request.getRemoteAddr()) %>
 <br>
-Remote host: <%= request.getRemoteHost() %>
+Remote host: <%= util.HTMLFilter.filter(request.getRemoteHost()) %>
 <br>
-Authorization scheme: <%= request.getAuthType() %> 
+Authorization scheme: <%= util.HTMLFilter.filter(request.getAuthType()) %> 
 <br>
 Locale: <%= request.getLocale() %>
 <hr>
-The browser you are using is <% out.print(util.HTMLFilter.filter(request.getHeader("User-Agent"))); %>
+The browser you are using is
+<%= util.HTMLFilter.filter(request.getHeader("User-Agent")) %>
 <hr>
 </font>
 </body>
diff --git a/webapps/examples/jsp/source.jsp b/webapps/examples/jsp/source.jsp
index 3940796..d26ee51 100644 (file)
--- a/webapps/examples/jsp/source.jsp
+++ b/webapps/examples/jsp/source.jsp
@@ -17,4 +17,4 @@
 <%@ taglib uri="http://jakarta.apache.org/tomcat/examples-taglib"
         prefix="eg" %>
 
-<eg:ShowSource jspFile="<%= request.getQueryString() %>"/>
+<eg:ShowSource jspFile="<%= util.HTMLFilter.filter(request.getQueryString()) %>"/>
Unnamed repository; edit this file to name it for gitweb.