WW-2427:

Applied Don Brown's fix for escaping double quote in href to 2.0.x tree

git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/branches/STRUTS_2_0_X@630742 13f79535-47bb-0310-9956-ffa450edef68

core/src/main/java/org/apache/struts2/components/AbstractRemoteCallUIBean.java

@@ -60,7 +60,7 @@ public abstract class AbstractRemoteCallUIBean extends ClosingUIBean implements
         super.evaluateExtraParams();
 
         if (href != null)
-            addParameter("href", findString(href));
+             addParameter("href", ensureAttributeSafelyNotEscaped(findString(href)));
         if (errorText != null)
             addParameter("errorText", findString(errorText));
         if (loadingText != null)

core/src/main/java/org/apache/struts2/components/UIBean.java

@@ -790,6 +790,20 @@ public abstract class UIBean extends Component {
         }
     }
 
+    /**
+     * Ensures an unescaped attribute value cannot be vulnerable to XSS attacks
+     *
+     * @param val The value to check
+     * @return The escaped value
+     */
+    protected String ensureAttributeSafelyNotEscaped(String val) {
+        if (val != null) {
+            return val.replaceAll("\"", """);
+        } else {
+            return "";
+        }
+    }
+
     protected void evaluateExtraParams() {
     }
 

core/src/test/java/org/apache/struts2/views/jsp/ui/AnchorTest.java

@@ -56,4 +56,18 @@ public class AnchorTest extends AbstractUITagTest {
         verify(AnchorTest.class.getResource("href-1.txt"));
     }
 
+    public void testSimpleBadQuote() throws Exception {
+        TestAction testAction = (TestAction) action;
+        testAction.setFoo("bar");
+
+        AnchorTag tag = new AnchorTag();
+        tag.setPageContext(pageContext);
+
+        tag.setId("mylink");
+        tag.setHref("a\"");
+        tag.doStartTag();
+        tag.doEndTag();
+
+        verify(AnchorTest.class.getResource("href-2.txt"));
+    }
 }

core/src/test/resources/org/apache/struts2/views/jsp/ui/href-2.txt

@@ -0,0 +1,4 @@
+<a
+ id="mylink"
+ href="a&#34;">
+</a>