From 01584fabc74635d63a1b2670f18d8fcd1ee046cc Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukaszlenart@apache.org>
Date: Fri, 18 Oct 2013 08:10:07 +0000
Subject: [PATCH] WW-4213 Sanitises input param namespace to avoid XSS

git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/trunk@1533354 13f79535-47bb-0310-9956-ffa450edef68
---
 .../org/apache/struts2/config_browser/ActionNamesAction.java   | 3 ++-
 .../org/apache/struts2/config_browser/ShowConfigAction.java    | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/plugins/config-browser/src/main/java/org/apache/struts2/config_browser/ActionNamesAction.java b/plugins/config-browser/src/main/java/org/apache/struts2/config_browser/ActionNamesAction.java
index a2b847c16..fe2ab8663 100644
--- a/plugins/config-browser/src/main/java/org/apache/struts2/config_browser/ActionNamesAction.java
+++ b/plugins/config-browser/src/main/java/org/apache/struts2/config_browser/ActionNamesAction.java
@@ -24,6 +24,7 @@ package org.apache.struts2.config_browser;
 import com.opensymphony.xwork2.ActionSupport;
 import com.opensymphony.xwork2.config.entities.ActionConfig;
 import com.opensymphony.xwork2.inject.Inject;
+import org.apache.commons.lang3.StringEscapeUtils;
 import org.apache.struts2.StrutsConstants;
 
 import java.util.Set;
@@ -57,7 +58,7 @@ public class ActionNamesAction extends ActionSupport {
     }
 
     public void setNamespace(String namespace) {
-        this.namespace = namespace;
+        this.namespace = StringEscapeUtils.escapeEcmaScript(namespace);
     }
 
     @Inject(StrutsConstants.STRUTS_ACTION_EXTENSION)
diff --git a/plugins/config-browser/src/main/java/org/apache/struts2/config_browser/ShowConfigAction.java b/plugins/config-browser/src/main/java/org/apache/struts2/config_browser/ShowConfigAction.java
index ee8e9932b..1c8421517 100644
--- a/plugins/config-browser/src/main/java/org/apache/struts2/config_browser/ShowConfigAction.java
+++ b/plugins/config-browser/src/main/java/org/apache/struts2/config_browser/ShowConfigAction.java
@@ -27,6 +27,7 @@ import com.opensymphony.xwork2.inject.Inject;
 import com.opensymphony.xwork2.util.logging.Logger;
 import com.opensymphony.xwork2.util.logging.LoggerFactory;
 import com.opensymphony.xwork2.util.reflection.ReflectionProvider;
+import org.apache.commons.lang3.StringEscapeUtils;
 
 import java.beans.PropertyDescriptor;
 import java.util.Set;
@@ -81,7 +82,7 @@ public class ShowConfigAction extends ActionNamesAction {
     }
 
     public void setNamespace(String namespace) {
-        this.namespace = namespace;
+        this.namespace = StringEscapeUtils.escapeEcmaScript(namespace);
     }
 
     public String getActionName() {