From add2d23ca7a43fe14d03a2b230aa99c2fd9a2ec2 Mon Sep 17 00:00:00 2001 From: markt Date: Mon, 22 Nov 2010 17:19:07 +0000 Subject: [PATCH] Fix CVE-2010-4172. Multiple XSS in Manager web application git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1037778 13f79535-47bb-0310-9956-ffa450edef68 --- java/org/apache/catalina/manager/JspHelper.java | 2 +- webapps/docs/changelog.xml | 3 +++ webapps/manager/WEB-INF/jsp/sessionDetail.jsp | 13 ++++++------- webapps/manager/WEB-INF/jsp/sessionsList.jsp | 18 +++++++++--------- 4 files changed, 19 insertions(+), 17 deletions(-) diff --git a/java/org/apache/catalina/manager/JspHelper.java b/java/org/apache/catalina/manager/JspHelper.java index 80fdc77ab..b001339fa 100644 --- a/java/org/apache/catalina/manager/JspHelper.java +++ b/java/org/apache/catalina/manager/JspHelper.java @@ -54,7 +54,7 @@ public class JspHelper { } private static String localeToString(Locale locale) { if (locale != null) { - return locale.toString();//locale.getDisplayName(); + return escapeXml(locale.toString());//locale.getDisplayName(); } else { return ""; } diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index 9768b96eb..d54805abd 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -295,6 +295,9 @@ 50310: Fix display of Servlet information in Manager application. (markt) + + CVE-2010-4172: Multiple XSS in Manager application. (markt/kkolinko) + diff --git a/webapps/manager/WEB-INF/jsp/sessionDetail.jsp b/webapps/manager/WEB-INF/jsp/sessionDetail.jsp index e61933023..2cef06629 100644 --- a/webapps/manager/WEB-INF/jsp/sessionDetail.jsp +++ b/webapps/manager/WEB-INF/jsp/sessionDetail.jsp @@ -33,10 +33,10 @@ ContextName cn = new ContextName(path, version); Session currentSession = (Session)request.getAttribute("currentSession"); HttpSession currentHttpSession = currentSession.getSession(); - String currentSessionId = currentSession.getId(); - String submitUrl = response.encodeURL(((HttpServletRequest) - pageContext.getRequest()).getRequestURI() + "?path=" + path + - "&version=" + version); + String currentSessionId = JspHelper.escapeXml(currentSession.getId()); + String submitUrl = JspHelper.escapeXml(response.encodeURL( + ((HttpServletRequest) pageContext.getRequest()).getRequestURI() + + "?path=" + path + "&version=" + version)); %> @@ -50,7 +50,7 @@ Sessions Administration: details for <%= currentSessionId %> -

Details for Session <%= JspHelper.escapeXml(currentSessionId) %>

+

Details for Session <%= currentSessionId %>

@@ -142,7 +142,7 @@
- + <% if ("Primary".equals(request.getParameter("sessionType"))) { %> @@ -165,7 +165,6 @@

-

diff --git a/webapps/manager/WEB-INF/jsp/sessionsList.jsp b/webapps/manager/WEB-INF/jsp/sessionsList.jsp index e56d8a6ac..5b666ef6a 100644 --- a/webapps/manager/WEB-INF/jsp/sessionsList.jsp +++ b/webapps/manager/WEB-INF/jsp/sessionsList.jsp @@ -31,9 +31,9 @@ <% String path = (String) request.getAttribute("path"); String version = (String) request.getAttribute("version"); ContextName cn = new ContextName(path, version); - String submitUrl = response.encodeURL(((HttpServletRequest) - pageContext.getRequest()).getRequestURI() + "?path=" + path + - "&version=" + version); + String submitUrl = JspHelper.escapeXml(response.encodeURL( + ((HttpServletRequest) pageContext.getRequest()).getRequestURI() + + "?path=" + path + "&version=" + version)); Collection activeSessions = (Collection) request.getAttribute("activeSessions"); %> @@ -45,10 +45,10 @@ - Sessions Administration for <%= cn.getDisplayName() %> + Sessions Administration for <%= JspHelper.escapeXml(cn.getDisplayName()) %> -

Sessions Administration for <%= cn.getDisplayName() %>

+

Sessions Administration for <%= JspHelper.escapeXml(cn.getDisplayName()) %>

Tips:

    @@ -62,13 +62,13 @@
    Active HttpSessions informations - "/> + "/> <% String order = (String) request.getAttribute("order"); if (order == null || "".equals(order)) { order = "ASC"; } %> - + <%= JspHelper.formatNumber(activeSessions.size()) %> active Sessions
@@ -104,7 +104,7 @@ <% Iterator iter = activeSessions.iterator(); while (iter.hasNext()) { Session currentSession = (Session) iter.next(); - String currentSessionId = currentSession.getId(); + String currentSessionId = JspHelper.escapeXml(currentSession.getId()); String type; if (currentSession instanceof DeltaSession) { if (((DeltaSession) currentSession).isPrimarySession()) { @@ -125,7 +125,7 @@ out.print(currentSessionId); } else { %> - <%= JspHelper.escapeXml(currentSessionId) %> + <%= currentSessionId %> <% } %> -- 2.11.0