From 93866341ec5396d07b5829be55110ff09dc81bcd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9=20Gielen?= <rgielen@apache.org>
Date: Mon, 25 Feb 2008 06:26:12 +0000
Subject: [PATCH] WW-2427: Applied Don Brown's fix for escaping double quote in
 href to 2.0.x tree

git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/branches/STRUTS_2_0_X@630742 13f79535-47bb-0310-9956-ffa450edef68
---
 .../components/AbstractRemoteCallUIBean.java       |  2 +-
 .../java/org/apache/struts2/components/UIBean.java | 14 ++++++++++++++
 .../apache/struts2/views/jsp/ui/AnchorTest.java    | 14 ++++++++++++++
 .../org/apache/struts2/views/jsp/ui/href-2.txt     |  4 ++++
 4 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 core/src/test/resources/org/apache/struts2/views/jsp/ui/href-2.txt

diff --git a/core/src/main/java/org/apache/struts2/components/AbstractRemoteCallUIBean.java b/core/src/main/java/org/apache/struts2/components/AbstractRemoteCallUIBean.java
index e98d92504..ad037697e 100644
--- a/core/src/main/java/org/apache/struts2/components/AbstractRemoteCallUIBean.java
+++ b/core/src/main/java/org/apache/struts2/components/AbstractRemoteCallUIBean.java
@@ -60,7 +60,7 @@ public abstract class AbstractRemoteCallUIBean extends ClosingUIBean implements
         super.evaluateExtraParams();
 
         if (href != null)
-            addParameter("href", findString(href));
+             addParameter("href", ensureAttributeSafelyNotEscaped(findString(href)));
         if (errorText != null)
             addParameter("errorText", findString(errorText));
         if (loadingText != null)
diff --git a/core/src/main/java/org/apache/struts2/components/UIBean.java b/core/src/main/java/org/apache/struts2/components/UIBean.java
index 3ff42fc7a..3311cee4d 100644
--- a/core/src/main/java/org/apache/struts2/components/UIBean.java
+++ b/core/src/main/java/org/apache/struts2/components/UIBean.java
@@ -790,6 +790,20 @@ public abstract class UIBean extends Component {
         }
     }
 
+    /**
+     * Ensures an unescaped attribute value cannot be vulnerable to XSS attacks
+     *
+     * @param val The value to check
+     * @return The escaped value
+     */
+    protected String ensureAttributeSafelyNotEscaped(String val) {
+        if (val != null) {
+            return val.replaceAll("\"", "&#34;");
+        } else {
+            return "";
+        }
+    }
+
     protected void evaluateExtraParams() {
     }
 
diff --git a/core/src/test/java/org/apache/struts2/views/jsp/ui/AnchorTest.java b/core/src/test/java/org/apache/struts2/views/jsp/ui/AnchorTest.java
index 3d51383f5..777c3f317 100644
--- a/core/src/test/java/org/apache/struts2/views/jsp/ui/AnchorTest.java
+++ b/core/src/test/java/org/apache/struts2/views/jsp/ui/AnchorTest.java
@@ -56,4 +56,18 @@ public class AnchorTest extends AbstractUITagTest {
         verify(AnchorTest.class.getResource("href-1.txt"));
     }
 
+    public void testSimpleBadQuote() throws Exception {
+        TestAction testAction = (TestAction) action;
+        testAction.setFoo("bar");
+
+        AnchorTag tag = new AnchorTag();
+        tag.setPageContext(pageContext);
+
+        tag.setId("mylink");
+        tag.setHref("a\"");
+        tag.doStartTag();
+        tag.doEndTag();
+
+        verify(AnchorTest.class.getResource("href-2.txt"));
+    }
 }
diff --git a/core/src/test/resources/org/apache/struts2/views/jsp/ui/href-2.txt b/core/src/test/resources/org/apache/struts2/views/jsp/ui/href-2.txt
new file mode 100644
index 000000000..ec8b7ad36
--- /dev/null
+++ b/core/src/test/resources/org/apache/struts2/views/jsp/ui/href-2.txt
@@ -0,0 +1,4 @@
+<a
+ id="mylink"
+ href="a&#34;">
+</a>
\ No newline at end of file