Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-31 19:35:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Solves WW-3579 - escapes actionName and methodName to prevent XSS vulnerability

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/trunk@1076372 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Lukasz Lenart
2011-03-02 21:01:01 +00:00
parent 35bd1c8644
commit 885ab3459e
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xwork-core/src/main/java/com/opensymphony/xwork2/DefaultActionProxy.java
+6 -6
View File
@@ -23,12 +23,12 @@ import com.opensymphony.xwork2.util.LocalizedTextUtil;
import com.opensymphony.xwork2.util.logging.Logger;
import com.opensymphony.xwork2.util.logging.LoggerFactory;
import com.opensymphony.xwork2.util.profiling.UtilTimerStack;
import org.apache.commons.lang.StringEscapeUtils;
import org.apache.commons.lang.StringUtils;
import java.io.Serializable;
import java.util.Locale;
import org.apache.commons.lang.StringUtils;
/**
* The Default ActionProxy implementation
@@ -74,10 +74,10 @@ public class DefaultActionProxy implements ActionProxy, Serializable {
LOG.debug("Creating an DefaultActionProxy for namespace " + namespace + " and action name " + actionName);
}
this.actionName = actionName;
this.namespace = namespace;
this.executeResult = executeResult;
this.method = methodName;
this.actionName = StringEscapeUtils.escapeHtml(actionName);
this.namespace = namespace;
this.executeResult = executeResult;
this.method = StringEscapeUtils.escapeJavaScript(StringEscapeUtils.escapeHtml(methodName));
}
@Inject