Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-11 01:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

WW-4213 Sanitises input param namespace to avoid XSS

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/trunk@1533354 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Lukasz Lenart
2013-10-18 08:10:07 +00:00
parent 81f847022e
commit 01584fabc7
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/config-browser/src/main/java/org/apache/struts2/config_browser/ActionNamesAction.java
+2 -1
View File
@@ -24,6 +24,7 @@ package org.apache.struts2.config_browser;
import com.opensymphony.xwork2.ActionSupport;
import com.opensymphony.xwork2.config.entities.ActionConfig;
import com.opensymphony.xwork2.inject.Inject;
import org.apache.commons.lang3.StringEscapeUtils;
import org.apache.struts2.StrutsConstants;
import java.util.Set;
@@ -57,7 +58,7 @@ public class ActionNamesAction extends ActionSupport {
}
public void setNamespace(String namespace) {
this.namespace = namespace;
this.namespace = StringEscapeUtils.escapeEcmaScript(namespace);
}
@Inject(StrutsConstants.STRUTS_ACTION_EXTENSION)
plugins/config-browser/src/main/java/org/apache/struts2/config_browser/ShowConfigAction.java
+2 -1
View File
@@ -27,6 +27,7 @@ import com.opensymphony.xwork2.inject.Inject;
import com.opensymphony.xwork2.util.logging.Logger;
import com.opensymphony.xwork2.util.logging.LoggerFactory;
import com.opensymphony.xwork2.util.reflection.ReflectionProvider;
import org.apache.commons.lang3.StringEscapeUtils;
import java.beans.PropertyDescriptor;
import java.util.Set;
@@ -81,7 +82,7 @@ public class ShowConfigAction extends ActionNamesAction {
}
public void setNamespace(String namespace) {
this.namespace = namespace;
this.namespace = StringEscapeUtils.escapeEcmaScript(namespace);
}
public String getActionName() {